These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-41675 is a high-severity vulnerability in the xmldom package, a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. The vulnerability allows attacker-controlled processing instruction data to be serialized into XML without validating or neutralizing the PI-closing sequence ?>. This can lead to an attacker terminating the processing instruction early a [truncated]
The CVE-2026-41674 vulnerability affects the xmldom package, specifically versions prior to 0.9.10 and 0.8.13. This package is a pure JavaScript implementation of the W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. The vulnerability arises from the package's serialization of DocumentType node fields (internalSubset, publicId, systemId) without proper escaping or validatio [truncated]
CVE-2026-41673 is a high-severity vulnerability in xmldom, a JavaScript XML DOM module. Versions prior to 0.9.10 and 0.8.13 are affected, allowing for a RangeError: Maximum call stack size exceeded due to seven recursive traversals in lib/dom.js operating without a depth limit. A sufficiently deeply nested DOM tree causes the application to crash. This issue has been patched in versions @xmldom/xmldom ver [truncated]
CVE-2026-34601 is a HIGH severity vulnerability in xmldom, a JavaScript XML DOM module. The vulnerability allows for XML structure injection via attacker-supplied strings containing the CDATA terminator ]]> . During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active XML markup in [truncated]