8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41674

CVE-2026-41674: xmldom: XML injection through unvalidated DocumentType serialization

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41674

CVE-2026-41674:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@xmldom/xmldom	npm	< 0.8.13	0.8.13
@xmldom/xmldom	npm	>= 0.9.0, < 0.9.10	0.9.10
xmldom	npm	<= 0.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an XML injection that occurs in a two-step process. First, an attacker needs to be able to control the inputs to the DOMImplementation.createDocumentType function. This function is flawed because it does not validate the publicId, systemId, or internalSubset arguments, instead storing them as-is within the created DocumentType node. This sets the stage for the injection.

Second, the application must serialize the document containing this crafted DocumentType node using XMLSerializer.serializeToString. This function is the second part of the vulnerability. When serializing the DocumentType node, it takes the previously stored publicId, systemId, and internalSubset values and writes them directly into the output XML string without any sanitization or escaping.

This allows an attacker to break out of the intended DOCTYPE declaration structure and inject arbitrary XML elements into the document. For example, by providing ]> in the internalSubset, an attacker can close the DOCTYPE declaration prematurely and inject elements that will be parsed as part of the XML body.

The patch confirms this analysis by introducing validation checks within the serialization logic for DocumentType nodes, but makes it an opt-in feature (requireWellFormed: true) to avoid breaking changes. The core vulnerable behavior remains the default. Therefore, any code path that calls XMLSerializer.serializeToString on a DocumentType node whose properties could be controlled by an attacker is vulnerable if the new requireWellFormed option is not used.

The two key functions that would appear in a runtime profile during exploitation are DOMImplementation.createDocumentType to create the malicious node, and XMLSerializer.serializeToString to trigger the injection during serialization.

Vulnerable functions

DOMImplementation.createDocumentType

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.