High severity7.5NVD Advisory· Published May 7, 2026· Updated Jul 15, 2026
CVE-2026-41675
CVE-2026-41675
Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled processing instruction data to be serialized into XML without validating or neutralizing the PI-closing sequence ?>. As a result, an attacker can terminate the processing instruction early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@xmldom/xmldomnpm | < 0.8.13 | 0.8.13 |
@xmldom/xmldomnpm | >= 0.9.0, < 0.9.10 | 0.9.10 |
xmldomnpm | <= 0.6.0 | — |
Affected products
19- osv-coords19 versionspkg:apk/chainguard/actions-runnerpkg:apk/chainguard/arangodb-3.11pkg:apk/chainguard/gitlab-rails-ce-18.11pkg:apk/chainguard/gitlab-rails-ce-19.0pkg:apk/chainguard/gitlab-rails-ce-19.1pkg:apk/chainguard/gitlab-rails-ce-fips-18.11pkg:apk/chainguard/gitlab-rails-ce-fips-19.0pkg:apk/chainguard/gitlab-rails-ce-fips-19.1pkg:apk/chainguard/librechatpkg:apk/chainguard/npmpkg:apk/chainguard/safpkg:apk/chainguard/sqlpadpkg:apk/chainguard/wazuh-dashboard-security-pluginpkg:apk/chainguard/wazuh-dashboard-security-plugin-fipspkg:apk/wolfi/npmpkg:apk/wolfi/safpkg:apk/wolfi/sqlpadpkg:npm/%40xmldom/xmldompkg:npm/xmldom
< 2.334.0-r1+ 18 more
- (no CPE)range: < 2.334.0-r1
- (no CPE)range: < 3.11.14.3-r6
- (no CPE)range: < 18.11.6-r7
- (no CPE)range: < 19.0.5-r21
- (no CPE)range: < 19.1.3-r2
- (no CPE)range: < 18.11.7-r1
- (no CPE)range: < 19.0.5-r2
- (no CPE)range: < 19.1.3-r4
- (no CPE)range: < 0.8.4-r6
- (no CPE)range: < 11.13.0-r1
- (no CPE)range: < 1.6.0-r0
- (no CPE)range: < 7.5.7-r18
- (no CPE)range: < 4.14.6-r3
- (no CPE)range: < 4.14.6-r1
- (no CPE)range: < 11.13.0-r1
- (no CPE)range: < 1.6.0-r0
- (no CPE)range: < 7.5.7-r18
- (no CPE)range: < 0.8.13
- (no CPE)range: <= 0.6.0
Patches
Vulnerability mechanics
References
10- github.com/advisories/GHSA-x6wf-f3px-wcqxghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-41675ghsaADVISORY
- github.com/xmldom/xmldom/commit/7207a4b0e0bcc228868075ed991665ef9f73b1c2nvdWEB
- github.com/xmldom/xmldom/releases/tag/0.8.13nvdWEB
- github.com/xmldom/xmldom/releases/tag/0.9.10nvdWEB
- github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqxnvdWEB
- access.redhat.com/errata/RHSA-2026:26234nvd
- access.redhat.com/security/cve/CVE-2026-41675nvd
- bugzilla.redhat.com/show_bug.cginvd
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41675.jsonnvd
News mentions
1- Patch Tuesday - May 2026Rapid7 Blog · May 13, 2026