Is CVE-2026-83616 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-83616 being exploited in the wild.

How severe is CVE-2026-83616?

High severity, with a CVSS score of 4, published 1 September 2026.

Which products and versions are affected?

@xmldom/xmldom (npm) SEMVER:introduced=0.7.0,fixed=0.8.15; xmldom (npm) SEMVER:introduced=0,last_affected=0.6.0.

Is there a fix for CVE-2026-83616?

Yes. @xmldom/xmldom (npm): upgrade to 0.8.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-83616 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-83616?

Check whether you run @xmldom/xmldom (npm) or xmldom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-83616: xmldom Processing Instruction Target Injection in serialization

CVE-2026-83616 · Severity: high · CVSS 4 · Published 2026-09-01

xmldom is a popular JavaScript library for parsing and serializing XML documents. The library's processing instruction serialization does not adequately validate target names, allowing an attacker who can control the target string to break out of the XML processing instruction syntax and inject arbitrary XML content. This could enable cross-site scripting (XSS) attacks if the output is served as XHTML or processed by a browser-based XML parser.

Technologies: @xmldom/xmldom (npm), xmldom (npm). Vendors: npm.

Quick answers

Is CVE-2026-83616 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-83616 being exploited in the wild.
How severe is CVE-2026-83616?: High severity, with a CVSS score of 4, published 1 September 2026.
Which products and versions are affected?: @xmldom/xmldom (npm) SEMVER:introduced=0.7.0,fixed=0.8.15; xmldom (npm) SEMVER:introduced=0,last_affected=0.6.0.
Is there a fix for CVE-2026-83616?: Yes. @xmldom/xmldom (npm): upgrade to 0.8.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83616 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-83616?: Check whether you run @xmldom/xmldom (npm) or xmldom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@xmldom/xmldom (npm): upgrade to 0.8.15 or later
```
npm install @xmldom/xmldom@0.8.15
```

Technical details

The vulnerability exists in the Document.createProcessingInstruction(target, data) function, which accepts any string as the target parameter without validation. During XML serialization, processing instructions are formatted as "<?target data?>". The incomplete requireWellFormed validation in the serializer only checks for colons and the reserved "xml" prefix but fails to validate against the full XML Name production, critically missing characters like ">", "?", and whitespace that break PI syntax. An attacker can inject a ">" character in the target to prematurely close the PI boundary, allowing injection of arbitrary XML elements, text content, or additional processing instructions. When serialized with requireWellFormed:true (opt-in), this now throws InvalidStateError per the fix, but the default serialization path remains vulnerable. The vulnerability requires the attacker to control the target string passed to createProcessingInstruction() and have the serialized output consumed by a downstream XML parser or browser.

Affected products

xmldom @xmldom/xmldom 0.7.0 through 0.8.14, 0.9.0 through 0.9.11
xmldom xmldom 0.6.0 and earlier

Identifiers

CVE-2026-83616
GHSA-c7q8-3ch8-vqpv

Timeline

2026-08-21: disclosed
2026-09-08: patched: Fixed in @xmldom/xmldom 0.8.15 and 0.9.12; xmldom 0.6.0 has no patch
2026-09-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.