8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41675

CVE-2026-41675: xmldom: XML node injection through unvalidated processing instruction serialization

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled processing instruction data to be serialized into XML without validating or neutralizing the PI-closing sequence ?>. As a result, an attacker can terminate the processing instruction early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41675

CVE-2026-41675:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@xmldom/xmldom	npm	< 0.8.13	0.8.13
@xmldom/xmldom	npm	>= 0.9.0, < 0.9.10	0.9.10
xmldom	npm	<= 0.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a two-stage XML injection. It begins with the Document.createProcessingInstruction function, which fails to validate its data input. This allows a string containing the processing instruction closing delimiter ?> to be stored in a ProcessingInstruction node. The second stage occurs in XMLSerializer.serializeToString. When serializing the document, this function does not escape the ?> sequence within the ProcessingInstruction's data. Instead, it writes the data verbatim to the output. This causes the XML parser to interpret the ?> as the end of the processing instruction, and any subsequent content in the data string is injected into the main XML structure as active markup. The fix is opt-in, meaning that calls to serializeToString without the { requireWellFormed: true } option remain vulnerable.

Vulnerable functions

Document.createProcessingInstruction

lib/dom.js

This function creates a ProcessingInstruction node. It is vulnerable because it does not validate the 'data' argument, allowing a malicious string containing '?>' to be stored in the node's data. This malicious node is then improperly serialized by XMLSerializer.

XMLSerializer.serializeToString

lib/dom.js

This function serializes a DOM tree to a string. It is vulnerable because when it encounters a ProcessingInstruction node, it concatenates the node's data directly into the output string without sanitizing or escaping the '?>' sequence. This allows an attacker who controls the data of a ProcessingInstruction node to inject arbitrary XML into the serialized output. The patch adds a check for '?>' but it is only active when the `requireWellFormed: true` option is used, leaving the default behavior vulnerable.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.