CVE-2026-83608: xmldom: DocType `name` Injection Bypasses requireWellFormed
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENTTYPENODE branch in lib/dom.js validates publicId, systemId, and internalSubset under requireWellFormed: true but emits DocumentType.name verbatim. A name containing > or whitespace can terminate the <!DOCTYPE ...> declaration and inject sibling markup; the value can be supplied through createDocumentType() on the 0.8.x and unscoped lines or through a direct DocumentType.name property write on every affected line. The default path and legacy creation-time behavior remain permissive, while the vulnerable strict path fails to enforce an XML Name. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.8.15 - Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.9.12
Event History
Frequently Asked Questions
Which releases contain a fix?
The issue is fixed in @xmldom/xmldom 0.8.15 and 0.9.12. No fixed version is available for the unscoped xmldom package.
Does enabling requireWellFormed prevent this injection?
No. In affected versions, requireWellFormed validates the public ID, system ID, and internal subset, but does not enforce that DocumentType.name is a valid XML Name before emitting it.
What level of control is needed to exploit the issue?
An attacker needs control of a DocumentType name that is later serialized. On affected 0.8.x and unscoped lines this can be supplied through createDocumentType(), while every affected line permits it through a direct write to DocumentType.name.
Is the default behavior affected?
Yes. The default serialization path remains permissive, and legacy creation-time behavior is also permissive.