CVE-2026-83608
Received Received - Intake

XML External Entity Injection in xmldom

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENT_TYPE_NODE branch in lib/dom.js validates publicId, systemId, and internalSubset under requireWellFormed: true but emits DocumentType.name verbatim. A name containing > or whitespace can terminate the <!DOCTYPE ...> declaration and inject sibling markup; the value can be supplied through createDocumentType() on the 0.8.x and unscoped lines or through a direct DocumentType.name property write on every affected line. The default path and legacy creation-time behavior remain permissive, while the vulnerable strict path fails to enforce an XML Name. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-83608
EUVD
EUVD-2026-69219

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
@xmldom xmldom From 0.7.0 (inc) to 0.8.15 (exc)
@xmldom xmldom 0.8.15
@xmldom xmldom From 0.9.0 (inc) to 0.9.12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-91 The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-83608 is an XML injection vulnerability in the xmldom library. It occurs when the DocumentType.name property contains unsafe characters like > or whitespace. When serialized with requireWellFormed: true, the library fails to validate the name against XML Name rules, allowing attackers to break out of the <!DOCTYPE> declaration and inject arbitrary markup such as script tags or comments. This bypasses prior mitigations and can lead to XSS if the output is processed as XHTML.

Detection Guidance

To detect CVE-2026-83608, check if your system uses xmldom library versions between 0.7.0-0.8.14 or 0.9.0-0.9.11. Run commands like 'npm list xmldom' or 'npm list @xmldom/xmldom' to verify installed versions. If vulnerable versions are found, update to 0.8.15 or 0.9.12 immediately.

Impact Analysis

This vulnerability can lead to XML injection attacks, allowing attackers to inject malicious markup into XML documents. If the affected XML is later processed as XHTML, this could result in cross-site scripting (XSS) attacks. Additionally, it may cause denial-of-service conditions due to inefficient parsing of malformed input or deeply namespaced documents.

Compliance Impact

This vulnerability primarily enables XML injection attacks, which could allow unauthorized data access or manipulation. For GDPR, this may violate principles of data integrity and security. For HIPAA, it could compromise protected health information integrity if XML documents contain PHI. Strict validation of DocumentType names under requireWellFormed mitigates these risks.

Mitigation Strategies

Immediately update xmldom to version 0.8.15 or 0.9.12. If updating is not possible, enable requireWellFormed: true during serialization to enforce XML name validation. Review XML processing code to ensure DocumentType names are properly validated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83608. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart