CVE-2026-83611
Received Received - Intake

XML External Entity Injection in xmldom

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString() can silently accept an end tag such as </a\njunk>, close the element, and discard the trailing content. On 0.9.x, the lib/sax.js end-tag validator inherits the multiline flag from reg(), allowing the first line to satisfy the anchored XML ETag production; older lines have no equivalent residue validation. This parser differential can bypass a parse-before-trust well-formedness gate, although it does not inject the discarded content; onError on 0.9.x and errorHandler on 0.8.x are the relevant reporting interfaces. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-83611
EUVD
EUVD-2026-69225

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1286 The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the xmldom JavaScript library, which is used to parse and serialize XML documents. Due to improper handling of malformed end tags like </a junk>, the parser may incorrectly close elements and discard trailing content without proper error reporting. This issue exists in versions before @xmldom/xmldom 0.8.15 and 0.9.12, and in xmldom 0.6.0 and earlier.

Detection Guidance

To detect this vulnerability, check the installed version of xmldom or @xmldom/xmldom in your JavaScript environment. Run commands like 'npm list xmldom' or 'npm list @xmldom/xmldom' to identify vulnerable versions (0.6.0 and earlier, 0.8.x before 0.8.15, or 0.9.x before 0.9.12).

Review application code that uses DOMParser.parseFromString() for improper handling of malformed XML tags, particularly those with end tags like '</a junk>'.

Impact Analysis

This vulnerability could allow attackers to bypass XML parsing checks, potentially leading to incorrect XML processing. While it does not directly inject malicious content, it may cause applications to mishandle XML data, leading to logic errors or unexpected behavior in systems relying on this library.

Compliance Impact

This vulnerability may impact compliance with standards requiring strict XML validation, such as GDPR or HIPAA, by allowing malformed XML to be processed without error. Applications relying on xmldom to reject invalid input could inadvertently accept non-compliant data, potentially violating integrity requirements.

Mitigation Strategies

Upgrade to patched versions: @xmldom/xmldom 0.8.15 or 0.9.12, or remove xmldom 0.6.0 and earlier. If upgrading is not possible, implement input validation to reject malformed XML before parsing.

Apply strict XML parsing rules in your application to ensure well-formed input. Monitor error logs for parse failures or unexpected behavior during XML processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83611. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart