CVE-2026-83618: xmldom requireWellFormed DOCTYPE validation bypass via line terminator

CVE-2026-83618 · Severity: high · CVSS 4 · Published 2026-09-01

The @xmldom/xmldom library contains a flaw in its XML serialization validation that allows attackers to bypass security checks intended to prevent malicious DOCTYPE declarations. When serializing DOM documents with the requireWellFormed option enabled, an attacker can embed line breaks in publicId or systemId attributes to inject arbitrary XML markup (such as entity declarations) that breaks out of the DOCTYPE definition. This affects applications that rely on this validation to safely process untrusted XML documents.

Technologies: @xmldom/xmldom (npm). Vendors: npm.

Quick answers

Is CVE-2026-83618 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-83618 being exploited in the wild.
How severe is CVE-2026-83618?
High severity, with a CVSS score of 4, published 1 September 2026.
Which products and versions are affected?
@xmldom/xmldom (npm) >= 0.9.10, <= 0.9.11, SEMVER:introduced=0.9.10,fixed=0.9.12.
Is there a fix for CVE-2026-83618?
Yes. @xmldom/xmldom (npm): upgrade to 0.9.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83618 attacked?
It is attacked over the network.
Am I affected by CVE-2026-83618?
Check whether you run @xmldom/xmldom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @xmldom/xmldom (npm): upgrade to 0.9.12 or later
    npm install @xmldom/xmldom@0.9.12

Technical details

The vulnerability is a regex validation bypass in the XMLSerializer's requireWellFormed check for DocumentType publicId and systemId fields. The root cause stems from a shared regexp builder (in lib/grammar.js) that compiles validators with the multiline flag (m), causing anchors (^$) to match at line boundaries rather than string boundaries. An attacker can craft a publicId or systemId containing a valid XML literal on the first line followed by a line terminator (U+000A, U+000D, U+2028, U+2029) and malicious markup thereafter. The regex .test() method accepts this because the first line passes validation, but the entire value—including injected markup—is emitted verbatim into the DOCTYPE declaration. Attack requires control over DocumentType creation (via createDocumentType) and serialization with requireWellFormed: true option. The fix in version 0.9.12 rejects any publicId or systemId containing ECMAScript line terminators when requireWellFormed is enabled. Versions 0.8.x are unaffected due to use of non-multiline regex patterns; the unscoped xmldom package has no requireWellFormed feature. The default serialization path (without requireWellFormed) remains unchanged and continues to emit verbatim output.

Affected products

  • xmldom @xmldom/xmldom 0.9.10, 0.9.11

Identifiers

  • CVE-2026-83618
  • GHSA-vr34-hp96-76pp

Timeline

  • 2026-08-21: disclosed
  • 2026-09-08: advisory
  • 2026-09-08: patched: Version 0.9.12 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.