CVE-2026-83610: xmldom XML fragment injection in EntityReference serialization

CVE-2026-83610 · Severity: medium · CVSS 4 · Published 2026-09-01

xmldom is a widely-used JavaScript library for parsing and manipulating XML documents. Applications that create EntityReference nodes from user input and then serialize them can inadvertently emit attacker-controlled XML markup into the serialized output. This allows an attacker to inject malicious XML elements that become real structural elements when the fragment is re-parsed, potentially leading to XML-based injection attacks or data corruption in applications that process untrusted XML.

Technologies: @xmldom/xmldom (npm), xmldom (npm). Vendors: npm.

Quick answers

Is CVE-2026-83610 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-83610 being exploited in the wild.
How severe is CVE-2026-83610?
Medium severity, with a CVSS score of 4, published 1 September 2026.
Which products and versions are affected?
@xmldom/xmldom (npm) SEMVER:introduced=0.7.0,fixed=0.8.15; xmldom (npm) SEMVER:introduced=0,last_affected=0.6.0.
Is there a fix for CVE-2026-83610?
Yes. @xmldom/xmldom (npm): upgrade to 0.8.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83610 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-83610?
Check whether you run @xmldom/xmldom (npm) or xmldom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @xmldom/xmldom (npm): upgrade to 0.8.15 or later
    npm install @xmldom/xmldom@0.8.15

Technical details

The vulnerability is a XML fragment injection flaw in the EntityReference node serialization path. When serializeToString() is called with requireWellFormed: true on an EntityReference node with an attacker-controlled nodeName, the serializer emits the nodeName directly into an entity reference structure (&nodeName;) without validating that the name is a well-formed XML Name token. If the nodeName contains characters like '<', '>', or '&' followed by further XML syntax (e.g., 'safe; &lt;injected/&gt; &amp;x'), the serializer produces output like '&safe; &lt;injected/&gt; &amp;x;' which, when reparsed as XML, creates real injected elements. The root cause is insufficient validation in the ENTITY_REFERENCE_NODE serialization case compared to other node types. Impact is limited by the fact that createEntityReference() is rarely called directly with untrusted input in practice, and EntityReference nodes cannot be appended as element children. Patches (0.8.15, 0.9.12) add creation-time validation that rejects invalid XML Names by default, and add opt-in serializer-time validation when requireWellFormed: true is used.

Affected products

  • xmldom @xmldom/xmldom 0.7.0 to 0.8.14, 0.9.0 to 0.9.11
  • xmldom xmldom 0.6.0 and earlier

Identifiers

  • CVE-2026-83610
  • GHSA-6gmq-8vp8-gcm6

Timeline

  • 2026-08-21: disclosed: Vulnerability disclosed on GitHub Advisory Database
  • 2026-09-02: patched: Patched versions released: @xmldom/xmldom 0.8.15 and 0.9.12

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.