CVE-2026-41674: xmldom XXE Vulnerability

CVE-2026-41674 Overview

CVE-2026-41674 is an XML injection vulnerability [CWE-91] in the xmldom and @xmldom/xmldom JavaScript libraries. The packages serialize DocumentType node fields verbatim without escaping or validation. When internalSubset, publicId, or systemId contain attacker-controlled strings, XMLSerializer.serializeToString can terminate the DOCTYPE declaration early. This allows arbitrary markup to appear outside the DOCTYPE in the produced XML output. The flaw affects @xmldom/xmldom before versions 0.9.10 and 0.8.13, and the legacy xmldom package version 0.6.0 and earlier.

Critical Impact

Attackers controlling DocumentType field values can inject arbitrary XML markup into serialized output, breaking document integrity and enabling downstream parser confusion or content spoofing.

Affected Products

• @xmldom/xmldom versions prior to 0.9.10
• @xmldom/xmldom versions prior to 0.8.13
• xmldom version 0.6.0 and earlier

Discovery Timeline

• 2026-05-07 - CVE-2026-41674 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-41674

Vulnerability Analysis

The xmldom library implements a W3C-standard DOMParser and XMLSerializer for JavaScript environments. The serializer writes DocumentType node properties directly into the output stream when producing a DOCTYPE declaration. The implementation does not escape angle brackets, quotes, or other XML control characters before emitting these values. An attacker who can set internalSubset, publicId, or systemId programmatically can inject characters that close the DOCTYPE declaration prematurely. Subsequent input is treated as document-level markup. The flaw is classified as XML injection [CWE-91] and affects integrity of serialized XML without requiring authentication or user interaction.

Root Cause

The root cause is missing output encoding in the XMLSerializer logic that emits DocumentType fields. The serializer concatenates raw string values into the DOCTYPE declaration. It does not validate that publicId and systemId conform to XML production rules. It does not escape >, <, or quote characters in internalSubset content. The serializer trusts that DocumentType properties contain only well-formed values.

Attack Vector

Exploitation requires that an application pass attacker-controlled data into a DocumentType node and then serialize the document. A typical pattern occurs in services that build XML responses from user input, including SAML responses, RSS feeds, SOAP envelopes, or document conversion pipelines. An attacker supplies a string such as "PUBLIC\" \"http://x\"><script>...</script><!--" into a publicId field. After serialization, the resulting XML contains markup outside the DOCTYPE. Downstream consumers parse this injected content as legitimate document structure. The fix in commit 372008f9ae0e20fd69f761c7b79e202598267314 introduces validation and escaping for the affected fields. See the GitHub Security Advisory GHSA-f6ww-3ggp-fr8h for technical details.

Detection Methods for CVE-2026-41674

Indicators of Compromise

• Serialized XML output containing unexpected elements positioned between the DOCTYPE declaration and the root element.
• DOCTYPE declarations with publicId or systemId values containing >, <, or quote characters.
• Application logs showing parser warnings about extra content following the DOCTYPE in generated documents.

Detection Strategies

• Inventory Node.js dependencies for xmldom and @xmldom/xmldom using npm ls or software composition analysis tools.
• Audit application code for DOMImplementation.createDocumentType calls that accept untrusted input.
• Validate serialized XML output against expected schemas before transmission to consumers.

Monitoring Recommendations

• Monitor build pipelines and lockfiles for vulnerable xmldom versions during dependency resolution.
• Track outbound XML payloads from applications that perform DOCTYPE generation for anomalous structure.
• Alert on parser errors in downstream services that consume XML produced by serialization libraries.

How to Mitigate CVE-2026-41674

Immediate Actions Required

• Upgrade @xmldom/xmldom to version 0.9.10 or 0.8.13 immediately in all affected applications.
• Remove the legacy unmaintained xmldom package and migrate to the maintained @xmldom/xmldom fork.
• Audit all code paths that assign user input to DocumentType properties before redeploying.

Patch Information

The maintainers patched this issue in @xmldom/xmldom versions 0.9.10 and 0.8.13. Release notes are available at GitHub Release v0.9.10 and GitHub Release v0.8.13. The fix commit is published at GitHub Commit Details. The legacy xmldom package has not received a patch.

Workarounds

• Validate and sanitize input before assigning values to internalSubset, publicId, or systemId fields.
• Reject input containing <, >, or quote characters before passing it to DocumentType constructors.
• Strip DOCTYPE generation from response paths where DTDs are not required by the consuming parser.

# Configuration example
npm install @xmldom/xmldom@^0.9.10
npm uninstall xmldom
npm audit --production