CVE-2026-34601: xmldom XML Injection via Unsafe CDATA Serialization

Background

The xmldom package is a widely used library in the Node.js ecosystem that provides an implementation of the Document Object Model (DOM) for XML. It allows developers to create, manipulate, and serialize XML documents. However, a vulnerability exists in the way it handles CDATA sections, which can lead to XML injection attacks if untrusted user input is embedded within these sections.

Vulnerability Detail

The xmldom package allows attacker-controlled strings containing the CDATA terminator ']]>' to be inserted into a CDATASection node. During serialization, the XMLSerializer emits the CDATA content verbatim without rejecting or safely splitting the terminator. This oversight enables attackers to inject additional XML elements or attributes into the generated document, leading to potential integrity violations and business-logic manipulation. The vulnerability arises from the lack of validation in the createCDATASection method and unsafe serialization practices.

Workaround

If immediate patching is not possible, avoid using untrusted user input in CDATA sections. Instead, sanitize input before embedding it in XML documents. For example, you can replace ']]>' with a safe string:

const safeData = userInput.replace(/]]>/g, ']]]]><![CDATA[');
const cdata = doc.createCDATASection(safeData);

Conclusion

The xmldom package has a significant vulnerability that allows for XML injection through unsafe CDATA serialization. It is crucial for developers to update to the patched versions of the package or implement workarounds to mitigate the risk of exploitation. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of applications.

See every vulnerability recorded for xmldom →

FAQ