How severe is CVE-2026-34601?

CVE-2026-34601 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2026-34601 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-34601?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-34601 have an EU (EUVD) identifier?

Yes. CVE-2026-34601 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-18460.

When was CVE-2026-34601 published?

CVE-2026-34601 was published on 2026-04-02 and last updated on 2026-06-30.

CVE-2026-34601

CVE-2026-34601 is a high-severity vulnerability with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-91.

Key facts

Severity: High (CVSS 3.x base score 7.5)
EPSS exploit prediction: 0% (37th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-18460
Weakness: CWE-91
Published: 2026-04-02
Last modified: 2026-06-30

Description

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active XML markup in the serialized output, enabling XML structure injection and downstream business-logic manipulation. This issue has been patched in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and 0.9.9.

Frequently asked questions

What is CVE-2026-34601?: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active XML markup in the serialized output, enabling XML structure injection and downstream business-logic manipulation. This issue has been patched in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and 0.9.9.
How severe is CVE-2026-34601?: CVE-2026-34601 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2026-34601 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-34601?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-34601 have an EU (EUVD) identifier?: Yes. CVE-2026-34601 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-18460.
When was CVE-2026-34601 published?: CVE-2026-34601 was published on 2026-04-02 and last updated on 2026-06-30.

References

Other CWE-91 (XML Injection) vulnerabilities

CVE-2021-4140 — Critical (CVSS 10.0): It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability…
CVE-2023-43187 — Critical (CVSS 9.8): A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to…
CVE-2019-19450 — Critical (CVSS 9.8): paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates…
CVE-2021-37154 — Critical (CVSS 9.8): In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a…
CVE-2020-29128 — Critical (CVSS 9.8): petl before 1.68, in some configurations, allows resolution of entities in an XML document.
CVE-2020-25216 — Critical (CVSS 9.8): yWorks yEd Desktop before 3.20.1 allows code execution via an XSL Transformation when using an XML file in conjunction…

Browse all CWE-91 (XML Injection) vulnerabilities →