REDHAT-BUG-2454595: High severity npm/xmldom vulnerability

Q: What conditions are required for exploitation?

An attacker must be able to supply a string that is inserted into a CDATASection node and includes the CDATA terminator sequence ]]>. The application must then serialize that XML with XMLSerializer, allowing the supplied content to become active XML markup in the output.

Published Apr 2, 2026

Updated

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active XML markup in the serialized output, enabling XML structure injection and downstream business-logic manipulation. This issue has been patched in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and 0.9.9.

Affected Software

2 affected components

npm/xmldom<=0.6.0

npm/@xmldom/xmldom<=0.8.12, <=0.9.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade xmldom to a version that resolves this vulnerability.
Fixed in 0.6.0
Upgrade
Upgrade @xmldom/xmldom to a version that resolves this vulnerability.
Fixed in 0.8.12
Upgrade
Upgrade @xmldom/xmldom to a version that resolves this vulnerability.
Fixed in 0.9.9

Event History

Apr 2, 2026

Data Sourced

via Red Hat·07:04 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required for exploitation?

An attacker must be able to supply a string that is inserted into a CDATASection node and includes the CDATA terminator sequence ]]>. The application must then serialize that XML with XMLSerializer, allowing the supplied content to become active XML markup in the output.

Which applications are most exposed?

Applications using npm/xmldom or npm/@xmldom/xmldom are exposed when they place attacker-controlled data into CDATA sections and subsequently serialize the XML for consumption by downstream systems. The described impact is XML structure injection and possible downstream business-logic manipulation.

How can I determine whether my deployment is affected?

Check whether npm/@xmldom/xmldom is below 0.8.12 or below 0.9.9, and whether the application accepts untrusted content for CDATASection nodes before serializing XML. For npm/xmldom, the supplied information says versions 0.6.0 and earlier are affected but also says 0.6.0 is patched, so the exact fixed boundary should be verified against the vendor's advisory.