CVE-2026-83610 xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
Attackers can inject XML markup via invalid entity references in xmldom, potentially leading to code execution or data exposure if applications serialize these nodes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-83610?
CVE-2026-83610 is a medium-severity vulnerability in @xmldom xmldom, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReference(name) accepts an invalid name and the ENTITY_REFERENCE_NODE serializer emits the resulting nodeName directly in &name; form. Directly serializing the node or fragment with XMLSerializer.serializeToString() and requireWellFormed: true can therefore break the entity-reference boundary and produce attacker-controlled XML markup when reparsed. The parser does not ordinarily create these nodes, and element-child insertion is rejected, so exploitation requires an application to create and directly serialize an EntityReference. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.
Weakness: CWE-116
Which versions are affected by CVE-2026-83610?
6 open source packages ship an affected version, including @xmldom/xmldom and xmldom.
| Package | Affected | Fixed in |
|---|---|---|
@xmldom/xmldom npm | From 0.7.0 | 0.8.15 |
@xmldom/xmldom npm | From 0.7.0 | 0.8.15 |
@xmldom/xmldom npm | From 0.9.0 | 0.9.12 |
@xmldom/xmldom npm | From 0.9.0 | 0.9.12 |
xmldom npm | All versions to 0.6.0 | None |
xmldom npm | All versions to 0.6.0 | None |
How do I fix CVE-2026-83610?
Upgrade @xmldom/xmldom to a fixed version for your release line: 0.8.15 or 0.9.12.
Is CVE-2026-83610 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-83610 exists.
Sources
Also known as AZL-99339, CLEANSTART-2026-FD05711, CLSA-2026-1788561202, DEBIAN-CVE-2026-83610, ECHO-a905-3d03-0184, GHSA-6gmq-8vp8-gcm6 and 5 more.