xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active XML markup in the serialized output, enabling XML structure injection and downstream business-logic manipulation. This issue has been patched in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and 0.9.9.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer`     module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9,     xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a     CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without     rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active     XML markup in the serialized output, enabling XML structure injection and downstream business-logic     manipulation. This issue has been patched in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and     0.9.9. (CVE-2026-34601)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer`
    module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9,
    xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a
    CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without
    rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active
    XML markup in the serialized output, enabling XML structure injection and downstream business-logic
    manipulation. This issue has been patched in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and
    0.9.9. (CVE-2026-34601)

ID	Name	Product	Family	Type	Severity
304904	Linux Distros Unpatched Vulnerability : CVE-2026-34601	Nessus	Misc.	Local	high
439502	SCA: security update for @xmldom/xmldom (GHSA-wh4c-j3r5-mjhp)	Tenable Cloud Security	SCA Checks	Local	high
439502	SCA: security update for @xmldom/xmldom (GHSA-wh4c-j3r5-mjhp)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-34601

high

Tenable Plugins

high

high

high