CVE-2026-34601: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34601 is an XML injection vulnerability in the @xmldom/xmldom npm package caused by unsafe CDATA serialization that allows attacker-controlled markup insertion. The flaw affects @xmldom/xmldom versions prior to 0.8.12 and versions 0.9.0 through 0.9.8, as well as the legacy xmldom package (≤ 0.6.0, with no patch available). It was reported by researcher thesmartshadow, published to the GitHub Advisory Database on March 29, 2026, and assigned CVE status on April 2, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, xmldom Security Advisory).

The root cause (CWE-91: XML Injection) lies in two locations within lib/dom.js: Document.createCDATASection() accepted any string without validating for the CDATA terminator ]]>, and the XMLSerializer serialized CDATA section data verbatim without escaping or splitting that sequence (lines 2919–2920 in version 0.9.8). Because ]]> is not permitted inside CDATA content, an embedded terminator closes the CDATA section prematurely, and the remainder of the attacker-supplied string is interpreted as active XML markup by downstream parsers. Beyond createCDATASection(), the vulnerability is reachable via CharacterData.appendData(), replaceData(), insertData(), and direct assignment to .data or .textContent — all mutation paths that bypass the spec-level guard. Notably, the SAX parse path is unaffected because the parser's non-greedy CDSect regex stops at the first ]]> (GitHub Advisory, xmldom Security Advisory).

Successful exploitation allows an attacker to inject arbitrary XML elements and attributes into documents generated by a vulnerable application, violating the integrity of those documents. In applications that embed untrusted user input inside CDATA sections — common in XML exports, RSS/Atom feeds, SOAP integrations, and similar workflows — an attacker can insert security-relevant nodes such as <admin>true</admin> or <role>superuser</role> that downstream consumers may act upon. This can lead to privilege escalation, unauthorized workflow state changes, or business-logic bypass in any system that trusts the serialized XML output. Confidentiality and availability are not directly impacted (GitHub Advisory, xmldom Security Advisory).

No public exploit kit or weaponized tooling has been reported, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires no authentication, no user interaction, and low attack complexity — any network-accessible application that accepts untrusted input and places it into a CDATA section is potentially exploitable. The EPSS score is approximately 0.041% (6th percentile), indicating a low near-term exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Proof-of-concept code demonstrating both the vulnerable and fixed behaviors is included in the official security advisory (GitHub Advisory, xmldom Security Advisory).

1. Identify a vulnerable target: Locate an application that uses @xmldom/xmldom < 0.8.12 or 0.9.0–0.9.8 (or legacy xmldom ≤ 0.6.0) to generate XML documents that embed user-supplied data inside CDATA sections — common in XML export endpoints, SOAP APIs, or feed generators.
2. Craft a malicious payload: Prepare an input string containing the CDATA terminator followed by injected XML markup, for example: safe data]]><injected>true</injected><![CDATA[. When placed inside a CDATA section, this string will close the section early and insert the <injected> element as real XML markup.
3. Submit the payload: Provide the crafted string through any application input that is subsequently passed to createCDATASection(), appendData(), replaceData(), .data =, or .textContent = on a CDATASection node.
4. Trigger serialization: Cause the application to serialize the XML document (e.g., by triggering an export, API response, or feed generation). The XMLSerializer emits the CDATA content verbatim, causing the injected markup to appear as active XML in the output.
5. Exploit downstream consumers: Submit or relay the malformed XML to a downstream system that parses and trusts it. The injected elements (e.g., privilege flags, workflow states) are now present in the parsed document tree and may influence business logic (GitHub Advisory, xmldom Security Advisory).

• Application Logs: Unexpected or malformed XML output in application-generated documents, feeds, or API responses containing the sequence ]]> followed by XML tags in locations that should be plain text.
• Input Data: User-supplied strings containing the literal sequence ]]> in fields that are processed into CDATA sections (e.g., form fields, API parameters, file uploads destined for XML generation).
• Serialized Output: Generated XML documents where CDATA sections are unexpectedly closed early and additional elements appear between or after them — detectable by XML schema validation failures or unexpected element counts in parsed output.
• Downstream System Behavior: Anomalous privilege escalation, unexpected workflow state changes, or authorization decisions in systems consuming XML generated by the vulnerable application, particularly where injected element names like <admin>, <role>, or <enabled> appear in parsed documents.

Upgrade @xmldom/xmldom to version 0.8.12 (for the 0.8.x branch) or 0.9.9 (for the 0.9.x branch), which implement two mitigations: createCDATASection() now throws InvalidCharacterError when data contains ]]>, and XMLSerializer splits any ]]> in CDATA data into ]]]]> at serialization time. A subsequent release (0.9.10 / 0.8.13) deprecated the split behavior in favor of a requireWellFormed: true option on serializeToString(), which throws InvalidStateError on invalid CDATA — this is the recommended long-term approach. The legacy xmldom package (≤ 0.6.0) has no patch and should be migrated to @xmldom/xmldom. IBM has issued advisories for affected products including App Connect Enterprise, API Connect, Cloud Pak for AIOps, Cloud Pak for Integration, Cloud Pak for Data, and QRadar Suite Software (GitHub Advisory, xmldom Security Advisory, IBM ACE Advisory).

The vulnerability was reported by researcher thesmartshadow and analyzed by maintainer karfau, who published the advisory and fix simultaneously on March 29, 2026. IBM issued multiple security bulletins for its enterprise products that bundle @xmldom/xmldom, including App Connect Enterprise, API Connect, Cloud Pak for AIOps, Cloud Pak for Integration, Cloud Pak for Data, and QRadar Suite Software, indicating broad downstream impact in enterprise environments. OpenSUSE also issued security announcements referencing the CVE. Security news outlet SecurityOnline.info covered the vulnerability shortly after disclosure (xmldom Security Advisory, IBM ACE Advisory).