CVE catalog

CVE-2026-34601

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9,

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.47% · Oct 25, 2026

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active XML markup in the serialized output, enabling XML structure injection and downstream business-logic manipulation. This issue has been patched in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and 0.9.9.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-xmldomsid0.9.12-1fixed
Debiannode-xmldomforky0.9.12-1fixed
Debiannode-xmldomtrixie0.9.6-1vulnerable
Debiannode-xmldombookworm0.8.6-1vulnerable
Cpenode-xmldomNot reportedNot reportedvulnerable
Opensusepython-jupyterlab-templatestumbleweed0.5.3-1.1fixed
Opensuseheroic-games-launchertumbleweed2.20.1-5.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-xmldomsourcesid0.9.9-1not yet assignedNot reported[1132714]
Debiannode-xmldomsourceforky0.9.9-1not yet assignedNot reported[1132714]
Debiannode-xmldomsourcetrixie(unfixed)not yet assignedNot reported[1132714]
Debiannode-xmldomsourcebookworm(unfixed)not yet assignedNot reported[1132714]
Opensusepython-jupyterlab-templatesrpmtumbleweed0.5.3-1.1Not reportedOPENSUSE-SU-2026:10506-1Not reported
Opensuseheroic-games-launcherrpmtumbleweed2.20.1-5.1Not reportedOPENSUSE-SU-2026:10497-1Not reported

[Debian bug #1132714]

Notes

[trixie] node-xmldom: Minor issue [bookworm] node-xmldom: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [node-xmldom]Affected
    Details (2)

    • 0.8.6-1 · all · bookworm

      Affected

      nvd · node-xmldom · debian · bookworm; nvd · node-xmldom · debian · 12

    • 0.8.6-1 · all · bookworm

      Affected

      nvd · node-xmldom · debian · bookworm; nvd · node-xmldom · debian · 12

[Debian 13 (Trixie)]

  • [node-xmldom]Affected
    Details (2)

    • 0.9.6-1 · all · trixie

      Affected

      nvd · node-xmldom · debian · 13

    • 0.9.6-1 · all · trixie

      Affected

      nvd · node-xmldom · debian · 13

[openSUSE Tumbleweed]

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]