[Pkg-javascript-devel] Bug#1132714: node-xmldom: CVE-2026-34601

[Salvatore Bonaccorso]

Source: node-xmldom
Version: 0.9.8-2
Severity: important
X-Debbugs-Cc: carnil at debian.org
Control: found -1 0.9.6-1
Control: found -1 0.8.6-1

Hi,

The following vulnerability was published for node-xmldom.

CVE-2026-34601[0]:
| xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2
| Core) `DOMParser` and `XMLSerializer` module. In xmldom versions
| 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and
| 0.9.9, xmldom/xmldom allows attacker-controlled strings containing
| the CDATA terminator ]]> to be inserted into a CDATASection node.
| During serialization, XMLSerializer emitted the CDATA content
| verbatim without rejecting or safely splitting the terminator. As a
| result, data intended to remain text-only became active XML markup
| in the serialized output, enabling XML structure injection and
| downstream business-logic manipulation. This issue has been patched
| in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and
| 0.9.9.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-34601
    https://www.cve.org/CVERecord?id=CVE-2026-34601
[1] https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp

Regards,
Salvatore