CVE-2026-83618
Received Received - Intake

Prototype Pollution in xmldom Library

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with PubidLiteral_match and SystemLiteral_match expressions produced by reg() in lib/grammar.js, which inherit the multiline flag. A complete valid literal on the first line can therefore satisfy the matcher while U+000A, U+000D, U+2028, or U+2029 and breakout markup remain in the emitted <!DOCTYPE ...> declaration. This bypasses the strict-serialization mitigation for the earlier DocumentType injection advisory; creation and direct property assignment remain unvalidated by design. This issue is fixed in @xmldom/xmldom version 0.9.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-83618
EUVD
EUVD-2026-69244

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
xmldom xmldom 0.9.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-91 The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
CWE-625 The product uses a regular expression that does not sufficiently restrict the set of allowed values.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the xmldom library versions 0.9.10 to 0.9.12. It involves improper validation of DocumentType.publicId and DocumentType.systemId during XML serialization when requireWellFormed is set to true. Attackers can bypass strict serialization checks by injecting malicious markup into these fields, leading to potential XML injection attacks.

Detection Guidance

To detect this vulnerability, check if your system uses xmldom versions 0.9.10 or 0.9.11. Run: npm list xmldom or npm ls xmldom. If vulnerable, update to version 0.9.12 or later. No direct network detection commands are provided, but inspect XML parsing logs for malformed DOCTYPE declarations with line terminators.

Impact Analysis

This vulnerability could allow attackers to inject malicious XML content, potentially leading to data breaches, unauthorized access, or denial of service. Applications using affected xmldom versions may be vulnerable to XML-based attacks if they rely on the requireWellFormed serialization feature.

Compliance Impact

This vulnerability primarily impacts data integrity by allowing malicious markup injection through DOCTYPE declarations. While not directly tied to GDPR or HIPAA, it could lead to unauthorized data modification or disclosure if exploited in systems handling sensitive data, potentially violating compliance requirements for data integrity and security controls.

Mitigation Strategies

Update to @xmldom/xmldom version 0.9.12 or later to address the vulnerability. Avoid using the requireWellFormed: true option in vulnerable versions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83618. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart