CVE-2026-41674

HighCVSS 7.5/10Last modified Sep 10, 2026

Description

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-91

Affected software

Vendor	Product	Versions
xmldom	xmldom	xmldom <= 0.6.0; @xmldom/xmldom >= 0.9.0, < 0.9.10; @xmldom/xmldom < 0.8.13
Red Hat	Red Hat Developer Hub 1.8	—
Red Hat	Red Hat Developer Hub 1.9	—
Red Hat	Red Hat OpenShift Container Platform 4.20	—
Red Hat	Red Hat OpenShift Container Platform 4.21	—
Red Hat	Red Hat Build of Podman Desktop	—
Red Hat	Red Hat Fuse 7	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Self-service automation portal 2	—

References

Timeline

Published: May 7, 2026
Last modified: Sep 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-416757.5xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to ver CVE-2026-416767.5rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::d CVE-2026-416779.1rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.0 to before 0.10.78, the *_from_pem_callback APIs did no CVE-2026-416788.1rust-openssl provides OpenSSL bindings for the Rust programming language. From to before 0.10.78, aes::unwrap_key() contains an incorrect CVE-2026-4167910.0Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthen CVE-2026-41682.4A vulnerability was identified in Tecnick TCExam 16.5.0. This impacts an unknown function of the file /admin/code/tce_edit_group.php of the CVE-2026-416807.5Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By provi CVE-2026-416817.5rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes E CVE-2026-416826.9pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable to SRRF port con CVE-2026-416838.6i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3 CVE-2026-416846.5Incus is a system container and virtual machine manager. Prior to version 7.0.0, backup.GetInfo() trusts the inline backup/index.yaml config CVE-2026-416854.3Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can