CVE-2026-83610: xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReference(name) accepts an invalid name and the ENTITYREFERENCENODE serializer emits the resulting nodeName directly in &name; form. Directly serializing the node or fragment with XMLSerializer.serializeToString() and requireWellFormed: true can therefore break the entity-reference boundary and produce attacker-controlled XML markup when reparsed. The parser does not ordinarily create these nodes, and element-child insertion is rejected, so exploitation requires an application to create and directly serialize an EntityReference. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.8.15 - Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.9.12
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Exposure requires application code to call Document.createEntityReference() with attacker-influenced input and directly serialize the resulting EntityReference node or fragment using XMLSerializer.serializeToString() with requireWellFormed: true. The parser does not normally create these nodes, and inserting them as element children is rejected.
Are normal XML parsing workflows affected?
The parser does not ordinarily create the affected EntityReference nodes. The issue arises from application-created EntityReference nodes that are directly serialized and whose output is later reparsed.
What should be done if upgrading is not immediately possible?
Do not create EntityReference nodes from untrusted names, and avoid directly serializing application-created EntityReference nodes or fragments containing them. Validate entity-reference names before calling Document.createEntityReference().
Which versions contain fixes?
Fixed versions are @xmldom/xmldom 0.8.15 and 0.9.12. No fixed version is available for xmldom; affected releases include xmldom 0.6.0 and earlier.