xmldom npm Package Vulnerability: Injection Bypass Reported
- Severity
- HIGH
- Affected component
- @xmldom/xmldom (npm)
- Affected versions
- >= @xmldom/xmldom < 0.8.13, <= @xmldom/xmldom < 0.8.13 or >= xmldom <= 0.6.0, <= xmldom <= 0.6.0 or >= 0.9.9, <= 0.9.9 or >= 0.8.12, <= 0.8.12 or >= 0.8.11, <= 0.8.11 or >= 0.8.10, <= 0.8.10 or >= 0.9.8, <= 0.9.8 or >= 0.9.7, <= 0.9.7 or >= 0.9.6, <= 0.9.6 or >= 0.9.5, <= 0.9.5 or >= 0.9.4, <= 0.9.4 or >= 0.9.3, <= 0.9.3 or >= 0.9.2, <= 0.9.2 or >= 0.9.1, <= 0.9.1 or >= 0.9.0, <= 0.9.0 or >= 0.9.0-beta.11, <= 0.9.0-beta.11 or >= 0.9.0-beta.10, <= 0.9.0-beta.10 or >= 0.8.9, <= 0.8.9 or >= 0.9.0-beta.9, <= 0.9.0-beta.9 or >= 0.8.8, <= 0.8.8 or >= 0.9.0-beta.8, <= 0.9.0-beta.8 or >= 0.9.0-beta.7, <= 0.9.0-beta.7 or >= 0.8.7, <= 0.8.7 or >= 0.8.6, <= 0.8.6 or >= 0.9.0-beta.6, <= 0.9.0-beta.6 or >= 0.8.5, <= 0.8.5 or >= 0.8.4, <= 0.8.4 or >= 0.9.0-beta.5, <= 0.9.0-beta.5 or >= 0.9.0-beta.4, <= 0.9.0-beta.4 or >= 0.8.3, <= 0.8.3 or >= 0.9.0-beta.3, <= 0.9.0-beta.3 or >= 0.9.0-beta.2, <= 0.9.0-beta.2 or >= 0.9.0-beta.1, <= 0.9.0-beta.1 or >= 0.8.2, <= 0.8.2 or >= 0.8.1, <= 0.8.1 or >= 0.8.0, <= 0.8.0 or >= 0.7.3, <= 0.7.3 or >= 0.7.2, <= 0.7.2 or >= 0.7.1, <= 0.7.1 or >= 0.7.0+scoped, <= 0.7.0+scoped or >= v0.7.0, <= v0.7.0 or >= 0.7.0+unscoped, <= 0.7.0+unscoped or >= 0.7.0, <= 0.7.0 or >= 0.6.0, <= 0.6.0
- Patched version
- Not yet available
An early warning has been issued regarding a high severity vulnerability in the @xmldom/xmldom npm package. The serializer appears to emit DocumentType `name` verbatim without validation, allowing injection. This is reportedly a bypass of the `requireWellFormed` control.
What happened
The @xmldom/xmldom npm package serializer is under investigation for emitting DocumentType `name` verbatim into the `<!DOCTYPE...>` declaration without validation. This reportedly allows injection, bypassing the `requireWellFormed` control. The vulnerability is tracked under multiple IDs including CVE-2026-41674 and several GHSA numbers. It has not been reported as exploited in the wild.
Affected versions include a wide range of @xmldom/xmldom releases. Specifically, versions greater than or equal to @xmldom/xmldom but less than 0.8.13, and various other combinations of version ranges as detailed in the threat data. Users of these versions should assess their exposure based on the provided version ranges.
What to do about it
- Monitor the official sources for patches and updates to the @xmldom/xmldom package.
- Upgrade to a fixed version of @xmldom/xmldom once a patch is available.
- Review your application's use of the @xmldom/xmldom serializer to ensure it is not vulnerable to DocumentType `name` injection.
- Consider implementing additional validation or sanitization for DocumentType `name` inputs as a temporary measure.
- No official fix has been published yet. Monitor the sources below for updates.
How 0Day would have caught this
@xmldom/xmldom is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are reportedly affected if you are using @xmldom/xmldom npm package in versions greater than or equal to @xmldom/xmldom but less than 0.8.13, or any of the other specified version ranges listed in the threat data.
What should I do right now?
Monitor for patches and upgrade to a fixed version of @xmldom/xmldom once available. Review your application's use of the serializer and consider additional validation or sanitization for DocumentType `name` inputs.
Is there an official patch available?
No official patch has been published yet. Continue to monitor the sources for updates.