Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReference(name) accepts an invalid name and the ENTITY_REFERENCE_NODE serializer emits the resulting nodeName directly in &name; form. Directly serializing the node or fragment with XMLSerializer.serializeToString() and requireWellFormed: true can therefore break the entity-reference boundary and produce attacker-controlled XML markup when reparsed. The parser does not ordinarily create these nodes, and element-child insertion is rejected, so exploitation requires an application to create and directly serialize an EntityReference. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.
Published: 2026-09-01
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: XML Fragment Injection
Action: Apply Patch
AI Analysis

Impact

A flaw in the xmldom library allows an entity reference node to be created with an invalid name. When that node is serialized with XMLSerializer.serializeToString() while requireWellFormed is true, the nodeName is emitted as raw XML. This can introduce attacker‑controlled XML fragments into the serialized output, leading to XML injection vulnerabilities if the output is parsed or evaluated by the application.

Affected Systems

The vulnerability exists in the @xmldom/xmldom and xmldom npm packages for all versions prior to 0.8.15 and 0.9.12. It also affects the older xmldom package for versions 0.6.0 and earlier. The issue is fixed in @xmldom/xmldom 0.8.15, 0.9.12, and newer releases.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an application to call Document.createEntityReference with a crafted name and then serialize the resulting node with requireWellFormed set to true. The resulting serialized output contains attacker‑controlled XML markup that can be re‑parsed by the application, potentially leading to XML injection vulnerabilities.

Generated by OpenCVE AI on September 2, 2026 at 04:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade @xmldom/xmldom to version 0.8.15 or newer (including 0.9.12 and later).
  • If an upgrade is not immediately possible, modify the application to avoid serializing EntityReference nodes with requireWellFormed:true or use a safe serializer that sanitizes node names.
  • Validate the name passed to Document.createEntityReference against the XML entity name syntax and reject any invalid names before node creation.

Generated by OpenCVE AI on September 2, 2026 at 04:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-6gmq-8vp8-gcm6 xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
History

Thu, 03 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 02 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-91
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

threat_severity

Moderate

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Xmldom
Xmldom xmldom
Vendors & Products Xmldom
Xmldom xmldom

Tue, 01 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReference(name) accepts an invalid name and the ENTITY_REFERENCE_NODE serializer emits the resulting nodeName directly in &name; form. Directly serializing the node or fragment with XMLSerializer.serializeToString() and requireWellFormed: true can therefore break the entity-reference boundary and produce attacker-controlled XML markup when reparsed. The parser does not ordinarily create these nodes, and element-child insertion is rejected, so exploitation requires an application to create and directly serialize an EntityReference. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.
Title xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
Weaknesses CWE-116
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Xmldom Xmldom
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-03T16:00:03.283Z

Reserved: 2026-08-31T20:36:25.743Z

Link: CVE-2026-83610

cve-icon Vulnrichment

Updated: 2026-09-03T15:59:32.646Z

cve-icon NVD

Status : Deferred

Published: 2026-09-01T15:17:39.107

Modified: 2026-09-08T21:11:31.703

Link: CVE-2026-83610

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-01T14:31:49Z

Links: CVE-2026-83610 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T04:45:17Z

Weaknesses
  • CWE-116

    Improper Encoding or Escaping of Output

  • CWE-91

    XML Injection (aka Blind XPath Injection)