CVE-2026-83618: xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with PubidLiteralmatch and SystemLiteralmatch expressions produced by reg() in lib/grammar.js, which inherit the multiline flag. A complete valid literal on the first line can therefore satisfy the matcher while U+000A, U+000D, U+2028, or U+2029 and breakout markup remain in the emitted <!DOCTYPE ...> declaration. This bypasses the strict-serialization mitigation for the earlier DocumentType injection advisory; creation and direct property assignment remain unvalidated by design. This issue is fixed in @xmldom/xmldom version 0.9.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.9.12
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are from 0.9.10 until 0.9.12 where serialization uses requireWellFormed: true. The issue concerns DocumentType publicId or systemId values passed to the serializer.
What must an attacker control to exploit this?
An attacker needs to influence a DocumentType.publicId or DocumentType.systemId value that is serialized. A valid literal on the first line followed by U+000A, U+000D, U+2028, or U+2029 and breakout markup can bypass validation.
Does requireWellFormed: true fully mitigate DocumentType injection?
No. In the affected versions, embedded line terminators bypass the publicId and systemId validation even when requireWellFormed is true. DocumentType creation and direct property assignment are unvalidated by design.
What version fixes the issue?
The issue is fixed in @xmldom/xmldom version 0.9.12.