Junglewise Threat Intelligence

CVE-2026-83610: xmldom XML fragment injection in EntityReference serialization

CVE-2026-83610 · Severity: medium · CVSS 4 · Published 2026-09-02

Executive brief

xmldom is a widely-used JavaScript library for parsing and manipulating XML documents. Applications that create EntityReference nodes from user input and then serialize them can inadvertently emit attacker-controlled XML markup into the serialized output. This allows an attacker to inject malicious XML elements that become real structural elements when the fragment is re-parsed, potentially leading to XML-based injection attacks or data corruption in applications that process untrusted XML.

Technical details

The vulnerability is a XML fragment injection flaw in the EntityReference node serialization path. When serializeToString() is called with requireWellFormed: true on an EntityReference node with an attacker-controlled nodeName, the serializer emits the nodeName directly into an entity reference structure (&nodeName;) without validating that the name is a well-formed XML Name token. If the nodeName contains characters like '<', '>', or '&' followed by further XML syntax (e.g., 'safe; &lt;injected/&gt; &amp;x'), the serializer produces output like '&safe; &lt;injected/&gt; &amp;x;' which, when reparsed as XML, creates real injected elements. The root cause is insufficient validation in the ENTITY_REFERENCE_NODE serialization case compared to other node types. Impact is limited by the fact that createEntityReference() is rarely called directly with untrusted input in practice, and EntityReference nodes cannot be appended as element children. Patches (0.8.15, 0.9.12) add creation-time validation that rejects invalid XML Names by default, and add opt-in serializer-time validation when requireWellFormed: true is used.

Affected products

  • xmldom @xmldom/xmldom 0.7.0 to 0.8.14, 0.9.0 to 0.9.11
  • xmldom xmldom 0.6.0 and earlier

Timeline

  • 2026-08-21: disclosed: Vulnerability disclosed on GitHub Advisory Database
  • 2026-09-02: patched: Patched versions released: @xmldom/xmldom 0.8.15 and 0.9.12

References