REDHAT-BUG-2467629: High severity npm/@xmldom/xmldom vulnerability

Q: Which package versions need remediation?

@xmldom/xmldom versions before 0.9.10 on the 0.9 line and before 0.8.13 on the 0.8 line are affected. The xmldom package is affected at version 0.6.0 and earlier.

Q: What must an attacker control to exploit this issue?

An attacker must be able to supply processing-instruction data that is later serialized as XML. The malicious data includes a processing-instruction closing sequence (?>), allowing the attacker to end the instruction and add arbitrary XML nodes to the serialized output.

Published May 7, 2026

Updated

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled processing instruction data to be serialized into XML without validating or neutralizing the PI-closing sequence ?>. As a result, an attacker can terminate the processing instruction early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

Affected Software

2 affected components

npm/@xmldom/xmldom<0.9.10, <0.8.13

npm/xmldom<0.6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade @xmldom/xmldom to a version that resolves this vulnerability.
Fixed in 0.9.10
Upgrade
Upgrade @xmldom/xmldom to a version that resolves this vulnerability.
Fixed in 0.8.13

Event History

May 7, 2026

Data Sourced

via Red Hat·05:02 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which package versions need remediation?

@xmldom/xmldom versions before 0.9.10 on the 0.9 line and before 0.8.13 on the 0.8 line are affected. The xmldom package is affected at version 0.6.0 and earlier.

What must an attacker control to exploit this issue?

An attacker must be able to supply processing-instruction data that is later serialized as XML. The malicious data includes a processing-instruction closing sequence (?>), allowing the attacker to end the instruction and add arbitrary XML nodes to the serialized output.

What should be done if the affected package is in use?

Upgrade @xmldom/xmldom to 0.9.10 or 0.8.13, as applicable. Until upgrading, avoid serializing XML that contains attacker-controlled processing-instruction data.

How can I determine whether an application is exposed?

Check whether the application depends on xmldom 0.6.0 or earlier, or on an @xmldom/xmldom release older than 0.9.10 or 0.8.13. Exposure additionally requires a code path that accepts untrusted processing-instruction data and serializes it into XML.