CVE-2026-83616: xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

Q: What conditions are required for exploitation?

An attacker must be able to influence the target passed to Document.createProcessingInstruction(target, data) and have the resulting document serialized. Targets containing characters such as >, ?, whitespace, or other invalid XML-name characters can terminate or alter the emitted processing instruction and inject XML structure.

Published Sep 1, 2026

Updated

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstruction(target, data) in lib/dom.js accepts an unvalidated target, while the requireWellFormed: true serializer checks only for a colon and the reserved case-insensitive xml name on 0.9.x and performs no target check on 0.8.x. Because serialization emits <?target data?>, a target containing >, ?, whitespace, or another invalid XML-name character can break the processing-instruction boundary and inject XML structure. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

Affected Software

2 affected components

npm/@xmldom/xmldom>=0.6.0<0.8.15, <0.8.15, >=0.9.0<0.9.12, <0.9.12

npm/xmldom

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade @xmldom/xmldom to a version that resolves this vulnerability.
Fixed in 0.8.15
Upgrade
Upgrade @xmldom/xmldom to a version that resolves this vulnerability.
Fixed in 0.9.12

Event History

Sep 1, 2026

CVE Published

via MITRE·02:45 PM

Data Sourced

via MITRE·02:45 PM

DescriptionWeakness

Frequently Asked Questions

What conditions are required for exploitation?

An attacker must be able to influence the target passed to Document.createProcessingInstruction(target, data) and have the resulting document serialized. Targets containing characters such as >, ?, whitespace, or other invalid XML-name characters can terminate or alter the emitted processing instruction and inject XML structure.

Does requireWellFormed: true prevent this issue?

No. On 0.9.x, requireWellFormed checks only for a colon and the reserved case-insensitive xml name; on 0.8.x, it performs no processing-instruction target validation. Invalid targets can therefore still be serialized.

Which package versions have a fix?

@xmldom/xmldom is fixed in versions 0.8.15 and 0.9.12. xmldom has no fixed version available; the issue affects version 0.6.0 and earlier.

What can be done if an upgrade is not immediately possible?

Do not pass untrusted values as processing-instruction targets. Validate targets as valid XML names and reject values containing characters that can alter the processing-instruction boundary, including >, ?, and whitespace.