REDHAT-BUG-2467631: High severity npm/@xmldom/xmldom vulnerability

Q: Who is exposed to this issue?

Applications using affected xmldom or @xmldom/xmldom versions are exposed when they serialize XML documents containing comment content that an attacker can control.

Q: What does an attacker need to exploit it?

The attacker needs a way to supply comment text that is later passed through XML serialization. They can use comment-breaking sequences to end the comment and insert arbitrary XML nodes into the serialized output.

Q: Which versions contain fixes?

Fixes are available in @xmldom/xmldom 0.9.10 and 0.8.13. The issue affects xmldom 0.6.0 and earlier, while the provided information does not identify a fixed release for the xmldom package.

Q: What can be done if upgrading is not immediately possible?

Do not allow untrusted input to become XML comment content before serialization. Validate or neutralize comment-breaking sequences in attacker-controlled comment data.

Published May 7, 2026

Updated

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment-breaking sequences. As a result, an attacker can terminate the comment early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

Affected Software

4 affected components

npm/@xmldom/xmldom>=0.9.10<0.9.10

npm/@xmldom/xmldom<0.9.10

npm/@xmldom/xmldom<0.8.13

npm/xmldom<=0.6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade @xmldom/xmldom to a version that resolves this vulnerability.
Fixed in 0.9.10
Upgrade
Upgrade @xmldom/xmldom to a version that resolves this vulnerability.
Fixed in 0.8.13

Event History

May 7, 2026

Data Sourced

via Red Hat·05:02 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications using affected xmldom or @xmldom/xmldom versions are exposed when they serialize XML documents containing comment content that an attacker can control.

What does an attacker need to exploit it?

The attacker needs a way to supply comment text that is later passed through XML serialization. They can use comment-breaking sequences to end the comment and insert arbitrary XML nodes into the serialized output.

Which versions contain fixes?

Fixes are available in @xmldom/xmldom 0.9.10 and 0.8.13. The issue affects xmldom 0.6.0 and earlier, while the provided information does not identify a fixed release for the xmldom package.

What can be done if upgrading is not immediately possible?

Do not allow untrusted input to become XML comment content before serialization. Validate or neutralize comment-breaking sequences in attacker-controlled comment data.

REDHAT-BUG-2467631: High severity npm/@xmldom/xmldom vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Which versions contain fixes?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Which versions contain fixes?

What can be done if upgrading is not immediately possible?