GHSA-j759-j44w-7fr8Published

xmldom: XML node injection through unvalidated comment serialization

cve-program · CVE-2026-41672

Published

xmldom

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "xmldom",
                    "product": "xmldom",
                    "versions": [
                        {
                            "version": "xmldom <= 0.6.0",
                            "status": "affected"
                        },
                        {
                            "version": "@xmldom/xmldom >= 0.9.0, < 0.9.10",
                            "status": "affected"
                        },
                        {
                            "version": "@xmldom/xmldom < 0.8.13",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-28285

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: May 7, 2026, 3:36:16 AM

dateUpdated: Aug 28, 2026, 12:04:23 PM

4 related source bulletins · separate from aliases

msrc_CVE-2026-41672: xmldom: XML node injection through unvalidated comment serialization

CVE-2026-41672

RHSA-2026:60520: Red Hat Security Advisory: RHOAI 3.4.4 - Red Hat OpenShift AI

CVE-2025-66471 · CVE-2025-66626 · CVE-2025-71329 · CVE-2025-71330 · CVE-2026-0545 · CVE-2026-2614 · CVE-2026-5241 · CVE-2026-5422 · CVE-2026-6322 · CVE-2026-6734 · CVE-2026-8643 · CVE-2026-9697 · CVE-2026-12143 · CVE-2026-12151 · CVE-2026-12243 · CVE-2026-12481 · CVE-2026-13149 · CVE-2026-13311 · CVE-2026-13676 · CVE-2026-13717 · CVE-2026-14450 · CVE-2026-15154 · CVE-2026-15218 · CVE-2026-15378 · CVE-2026-15467 · CVE-2026-15581 · CVE-2026-16745 · CVE-2026-18608 · CVE-2026-18611 · CVE-2026-18617 · CVE-2026-18620 · CVE-2026-18621 · CVE-2026-18948 · CVE-2026-18951 · CVE-2026-18982 · CVE-2026-25681 · CVE-2026-27136 · CVE-2026-32280 · CVE-2026-32283 · CVE-2026-33079 · CVE-2026-33245 · CVE-2026-33811 · CVE-2026-33814 · CVE-2026-34993 · CVE-2026-35397 · CVE-2026-39820 · CVE-2026-39821 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39835 · CVE-2026-40171 · CVE-2026-41672 · CVE-2026-41673 · CVE-2026-41675 · CVE-2026-42211 · CVE-2026-42215 · CVE-2026-42264 · CVE-2026-42266 · CVE-2026-42284 · CVE-2026-42305 · CVE-2026-42311 · CVE-2026-42338 · CVE-2026-42342 · CVE-2026-42499 · CVE-2026-42502 · CVE-2026-42508 · CVE-2026-42557 · CVE-2026-44017 · CVE-2026-44018 · CVE-2026-44020 · CVE-2026-44240 · CVE-2026-44244 · CVE-2026-44289 · CVE-2026-44290 · CVE-2026-44291 · CVE-2026-44292 · CVE-2026-44293 · CVE-2026-44486 · CVE-2026-44487 · CVE-2026-44488 · CVE-2026-44492 · CVE-2026-44494 · CVE-2026-44495 · CVE-2026-44496 · CVE-2026-44513 · CVE-2026-44660 · CVE-2026-44705 · CVE-2026-44724 · CVE-2026-44727 · CVE-2026-44827 · CVE-2026-44843 · CVE-2026-45292 · CVE-2026-45623 · CVE-2026-45736 · CVE-2026-45740 · CVE-2026-45804 · CVE-2026-46595 · CVE-2026-46597 · CVE-2026-46625 · CVE-2026-47214 · CVE-2026-48526 · CVE-2026-48710 · CVE-2026-48712 · CVE-2026-48779 · CVE-2026-48801 · CVE-2026-49476 · CVE-2026-49477 · CVE-2026-49851 · CVE-2026-49978 · CVE-2026-50193 · CVE-2026-53550 · CVE-2026-54058 · CVE-2026-54060 · CVE-2026-54283 · CVE-2026-54293 · CVE-2026-55379 · CVE-2026-55380 · CVE-2026-55685 · CVE-2026-56121 · CVE-2026-56208 · CVE-2026-56209 · CVE-2026-56210 · CVE-2026-56211 · CVE-2026-58049 · CVE-2026-59197 · CVE-2026-59199 · CVE-2026-59200 · CVE-2026-59204 · CVE-2026-59205 · CVE-2026-59869 · CVE-2026-59873 · CVE-2026-59874 · CVE-2026-59884 · CVE-2026-59885 · CVE-2026-59886 · CVE-2026-64835 · CVE-2026-64849 · CVE-2026-69152 · CVE-2026-69192 · CVE-2026-69243 · CVE-2026-69244

RHSA-2026:26234: Red Hat Security Advisory: Red Hat Developer Hub 1.9.5 release.

CVE-2026-6321 · CVE-2026-6322 · CVE-2026-24781 · CVE-2026-32281 · CVE-2026-41242 · CVE-2026-41672 · CVE-2026-41673 · CVE-2026-41674 · CVE-2026-41675 · CVE-2026-44293

WID-SEC-W-2026-1833: IBM App Connect Enterprise (basic-ftp, xmldom): Mehrere Schwachstellen

CVE-2026-39983 · CVE-2026-41324 · CVE-2026-41672 · CVE-2026-41673 · CVE-2026-41674 · CVE-2026-41675

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-41672

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-91

Original publisher date fields

published: 2026-05-07T04:16:33.087

lastModified: 2026-08-28T16:17:57.720

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-j759-j44w-7fr8

Published

@xmldom/xmldom

npm

SEMVER · introduced 0 → fixed 0.8.13

@xmldom/xmldom

npm

SEMVER · introduced 0.9.0 → fixed 0.9.10

xmldom

npm

SEMVER · introduced 0 → last_affected 0.6.0

Original source record · Cite this exact observation · Complete original publisher JSON