CVE-2026-41675

A flaw was found in xmldom. A remote attacker can exploit this vulnerability by providing specially crafted processing instruction data. Due to improper validation of the processing instruction closing sequence, the attacker can terminate the instruction prematurely and inject arbitrary XML nodes into the serialized output. This can lead to data manipulation and integrity issues within applications that process the affected XML.

This Important flaw in xmldom allows a remote attacker to inject arbitrary XML nodes into serialized output. This occurs due to insufficient validation of processing instruction data, enabling premature termination of instructions and subsequent data manipulation within applications that process affected XML. Red Hat products utilizing xmldom for XML processing may be susceptible if they handle untrusted XML input.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.