CVE-2026-41672: xmldom XXE Vulnerability

CVE-2026-41672 Overview

CVE-2026-41672 is an XML injection vulnerability in @xmldom/xmldom, a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. The package fails to validate or neutralize comment-breaking sequences when serializing attacker-controlled comment content into XML. An attacker can terminate a comment early using --> and inject arbitrary XML nodes into the serialized output. The flaw is tracked under [CWE-91] (XML Injection) and affects @xmldom/xmldom prior to versions 0.9.10 and 0.8.13, as well as the legacy xmldom package version 0.6.0 and earlier.

Critical Impact

Attackers can inject arbitrary XML structure into serialized documents, breaking integrity guarantees for downstream XML consumers including signature validators, configuration parsers, and SAML processors.

Affected Products

• @xmldom/xmldom versions prior to 0.9.10
• @xmldom/xmldom versions prior to 0.8.13
• xmldom version 0.6.0 and prior (legacy package)

Discovery Timeline

• 2026-05-07 - CVE-2026-41672 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-41672

Vulnerability Analysis

The vulnerability resides in the comment serialization path of the XMLSerializer. When a Comment node's data property contains the sequence -->, the serializer emits the data verbatim between <!-- and --> delimiters. The premature --> terminates the comment, and any subsequent text is parsed as XML markup by downstream consumers.

This breaks the integrity of the serialized document. An attacker controlling comment content can inject elements, attributes, or processing instructions that were never part of the original DOM. Applications that round-trip XML through xmldom — including SAML assertion processors, SOAP middleware, and configuration loaders — may execute logic against attacker-controlled nodes.

Root Cause

The root cause is missing output validation in the comment serialization routine. The W3C DOM Parsing specification (§3.2.1.3) requires that when requireWellFormed is true, the serializer throw InvalidStateError if comment data contains --, ends with -, or contains characters outside the XML Char production. The vulnerable versions did not enforce this check, allowing comment-breaking sequences to pass through unvalidated.

Attack Vector

The attack vector is network-accessible and requires no authentication or user interaction. An attacker submits XML or DOM input where comment content includes --> followed by injected markup. When the application serializes the DOM, the injected XML appears as legitimate structure in the output stream.

// Patch excerpt from index.d.ts — comment validation contract
/** Options accepted by `XMLSerializer.prototype.serializeToString`. */
interface XMLSerializerOptions {
    /**
     * When `true`, the serializer throws a DOMException with code `INVALID_STATE_ERR` if:
     * - A CDATASection node's data contains `"]]>"`.
     * - A Comment node's data contains `"-->"` (the injection sequence that terminates a
     *   comment). Comments whose data contains `"--"` but not `"-->"` are accepted on this
     *   branch — the 0.8.x parser does not validate bare `"--"` in comment content.
     *
     * @default false
     */
}
// Source: https://github.com/xmldom/xmldom/commit/b397540889086da868c30c366ad5c220d1a750c7

// Patch excerpt from lib/dom.js — createComment documentation
/**
 * @param {string} data
 * @returns {Comment}
 * @see https://dom.spec.whatwg.org/#dom-document-createcomment
 * @see https://www.w3.org/TR/xml/#NT-Comment XML 1.0 production [15]
 * @see https://www.w3.org/TR/DOM-Parsing/#dfn-concept-serialize-xml §3.2.1.3
 *
 *      Note: no validation is performed at creation time. When the resulting document is
 *      serialized with `requireWellFormed: true`, the serializer throws `InvalidStateError`
 *      if the comment data contains `--` anywhere, ends with `-`, or contains characters
 *      outside the XML Char production (W3C DOM Parsing §3.2.1.3). Without that option the
 *      data is emitted verbatim.
 */
createComment: function (data) {
    var node = new Comment(PDC);
}
// Source: https://github.com/xmldom/xmldom/commit/fda7cc313de30243fea35cada64e0bb12099c2a1

Detection Methods for CVE-2026-41672

Indicators of Compromise

• XML output containing comment data with embedded --> followed by additional element markup.
• Serialized documents where comment nodes are followed by unexpected sibling elements not present in the source DOM.
• Application logs showing parser warnings about unbalanced comment delimiters or duplicate elements after round-trip serialization.

Detection Strategies

• Inventory Node.js applications and dependency manifests (package.json, package-lock.json, yarn.lock) for @xmldom/xmldom and xmldom package references at vulnerable versions.
• Scan XML processing pipelines for use of XMLSerializer.serializeToString without the requireWellFormed: true option.
• Add unit tests that round-trip XML containing comments with --> payloads and assert that serialization either throws or escapes the sequence.

Monitoring Recommendations

• Monitor outbound XML payloads from services using xmldom for unexpected structural changes between input and output.
• Log and alert on InvalidStateError exceptions raised by the patched serializer, which indicate attempted comment injection.
• Track Software Bill of Materials (SBOM) drift to detect reintroduction of vulnerable xmldom versions during dependency updates.

How to Mitigate CVE-2026-41672

Immediate Actions Required

• Upgrade @xmldom/xmldom to version 0.9.10 or 0.8.13 immediately. See the GitHub Security Advisory GHSA-j759-j44w-7fr8.
• Migrate off the legacy xmldom package, which is unmaintained, to the @xmldom/xmldom fork at a patched version.
• Audit all code paths that accept untrusted XML input or untrusted strings passed to document.createComment().

Patch Information

Maintainers released fixes in @xmldom/xmldom 0.9.10 and @xmldom/xmldom 0.8.13. The patches were merged via Pull Request #987 and commits b397540 and fda7cc3. The fix causes the serializer to throw InvalidStateError when comment data contains --> and requireWellFormed is enabled.

Workarounds

• Set requireWellFormed: true when calling XMLSerializer.prototype.serializeToString after upgrading, so injection attempts raise exceptions rather than emit malformed XML.
• Sanitize untrusted strings before passing them to document.createComment() by rejecting any input containing --, trailing -, or non-XML Char codepoints.
• Validate serialized XML output against an expected schema before forwarding to downstream consumers such as signature verifiers or SAML processors.

# Upgrade to a patched release
npm install @xmldom/xmldom@0.9.10
# or for the 0.8.x branch
npm install @xmldom/xmldom@0.8.13

# Verify installed version
npm ls @xmldom/xmldom