GHSA-wh4c-j3r5-mjhpPublished

xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion

cve-program · CVE-2026-34601

Published

xmldom

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "xmldom",
                    "product": "xmldom",
                    "versions": [
                        {
                            "version": "xmldom <= 0.6.0",
                            "status": "affected"
                        },
                        {
                            "version": "@xmldom/xmldom < 0.8.12",
                            "status": "affected"
                        },
                        {
                            "version": "@xmldom/xmldom >= 0.9.0, < 0.9.9",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-18460

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Apr 2, 2026, 5:47:13 PM

dateUpdated: Jul 15, 2026, 1:04:09 AM

5 related source bulletins · separate from aliases

openSUSE-SU-2026:10506-1: jupyter-jupyterlab-templates-0.5.3-1.1 on GA media

CVE-2026-34601

WID-SEC-W-2026-1407: IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen

CVE-2026-26013 · CVE-2026-27142 · CVE-2026-28277 · CVE-2026-28684 · CVE-2026-32288 · CVE-2026-33151 · CVE-2026-33349 · CVE-2026-33532 · CVE-2026-33891 · CVE-2026-33894 · CVE-2026-33895 · CVE-2026-33896 · CVE-2026-33916 · CVE-2026-34601 · CVE-2026-35469 · CVE-2026-39406 · CVE-2026-39407 · CVE-2026-39408 · CVE-2026-39409 · CVE-2026-39410 · CVE-2026-39983 · CVE-2026-40175 · CVE-2026-40347 · CVE-2026-40895 · CVE-2026-41238 · CVE-2026-41239 · CVE-2026-41240 · CVE-2026-4923 · CVE-2026-4926

msrc_CVE-2026-34601: xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion

CVE-2026-34601

WID-SEC-W-2026-2933: Splunk SOAR: Mehrere Schwachstellen

CVE-2025-13465 · CVE-2025-13473 · CVE-2025-14550 · CVE-2025-15599 · CVE-2025-53859 · CVE-2025-6545 · CVE-2025-6547 · CVE-2025-66221 · CVE-2025-67724 · CVE-2025-67725 · CVE-2025-67726 · CVE-2025-68428 · CVE-2025-69873 · CVE-2026-0540 · CVE-2026-1207 · CVE-2026-1285 · CVE-2026-1287 · CVE-2026-1312 · CVE-2026-1642 · CVE-2026-2004 · CVE-2026-2005 · CVE-2026-2006 · CVE-2026-21226 · CVE-2026-21860 · CVE-2026-22702 · CVE-2026-22815 · CVE-2026-2391 · CVE-2026-24001 · CVE-2026-24040 · CVE-2026-24043 · CVE-2026-24133 · CVE-2026-24737 · CVE-2026-25535 · CVE-2026-25673 · CVE-2026-25674 · CVE-2026-25755 · CVE-2026-25940 · CVE-2026-26007 · CVE-2026-26996 · CVE-2026-27199 · CVE-2026-2739 · CVE-2026-27651 · CVE-2026-27654 · CVE-2026-27784 · CVE-2026-27959 · CVE-2026-28277 · CVE-2026-28684 · CVE-2026-28753 · CVE-2026-28755 · CVE-2026-29063 · CVE-2026-2950 · CVE-2026-30922 · CVE-2026-31898 · CVE-2026-31938 · CVE-2026-31958 · CVE-2026-32141 · CVE-2026-32597 · CVE-2026-32647 · CVE-2026-33228 · CVE-2026-33532 · CVE-2026-33671 · CVE-2026-33672 · CVE-2026-33750 · CVE-2026-34513 · CVE-2026-34514 · CVE-2026-34515 · CVE-2026-34516 · CVE-2026-34517 · CVE-2026-34518 · CVE-2026-34519 · CVE-2026-34520 · CVE-2026-34525 · CVE-2026-34601 · CVE-2026-35536 · CVE-2026-40087 · CVE-2026-40460 · CVE-2026-40701 · CVE-2026-41066 · CVE-2026-42215 · CVE-2026-42284 · CVE-2026-42934 · CVE-2026-42945 · CVE-2026-42946 · CVE-2026-44243 · CVE-2026-44244 · CVE-2026-4800 · CVE-2026-76356 · CVE-2026-76357 · CVE-2026-76358 · CVE-2026-76359 · CVE-2026-76360 · CVE-2026-76361 · CVE-2026-76362 · CVE-2026-76363 · CVE-2026-76364 · CVE-2026-76365 · CVE-2026-76366 · CVE-2026-76367 · CVE-2026-76368 · CVE-2026-76369 · CVE-2026-76370 · CVE-2026-9256

openSUSE-SU-2026:10497-1: heroic-games-launcher-2.20.1-5.1 on GA media

CVE-2026-34601

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-34601

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-91

Original publisher date fields

published: 2026-04-02T18:16:31.933

lastModified: 2026-07-21T19:10:00.107

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-wh4c-j3r5-mjhp

Published

xmldom

npm

SEMVER · introduced 0 → last_affected 0.6.0

@xmldom/xmldom

npm

SEMVER · introduced 0 → fixed 0.8.12

@xmldom/xmldom

npm

SEMVER · introduced 0.9.0 → fixed 0.9.9

Original source record · Cite this exact observation · Complete original publisher JSON