Junglewise Threat Intelligence

CVE-2026-83608: xmldom DocType name injection bypasses requireWellFormed

CVE-2026-83608 · Severity: medium · CVSS 4 · Published 2026-09-08

Executive brief

xmldom is a popular XML parser and DOM implementation used in JavaScript applications. The library's serializer can be tricked into emitting malicious XML markup by injecting special characters (like ">") into the DOCTYPE declaration's name field, even when security protections are enabled. An attacker who can influence the DOCTYPE name can break out of the declaration and inject arbitrary XML elements or scripts, potentially leading to code execution if the output is processed by a browser.

Technical details

The vulnerability is an XML injection flaw in the xmldom serializer's handling of DocumentType nodes. The serializer's requireWellFormed validation checks the publicId, systemId, and internalSubset fields but fails to validate the name field before emitting it verbatim into the <!DOCTYPE ...> declaration. By injecting a ">" character (or whitespace) in the DocumentType name, an attacker can terminate the DOCTYPE declaration early and inject arbitrary sibling markup into the serialized output. On version 0.9.x, the createDocumentType() function validates the name at creation time, but since DocumentType.name is a writable own-property, attackers can bypass creation-time checks via direct property assignment (dt.name = 'malicious'). On version 0.8.x and earlier, createDocumentType() does not validate the name at all, allowing direct injection at creation time. This is a complete bypass of the recommended mitigation (requireWellFormed: true) for prior xmldom injection CVEs. The fix validates the name field under requireWellFormed and is non-breaking but requires opt-in via explicit { requireWellFormed: true } at serialization time; existing code remains vulnerable unless updated.

Affected products

  • xmldom @xmldom/xmldom 0.7.0–0.8.14, 0.9.0–0.9.11
  • xmldom xmldom ≤0.6.0

Timeline

  • 2026-09-08: disclosed: GHSA-27p8-2357-5qqv published
  • 2026-08-21: patched: Security release 0.9.12 and 0.8.15 merged; patches validate DocType name under requireWellFormed

References