Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-83610— xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

Quick assessment

Affected
xmldom xmldom
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

xmldom 是一个纯 JavaScript 实现的模块，基于 W3C 标准（XML DOM Level 2 Core），提供 DOMParser 和 XMLSerializer 功能。在 @xmldom/xmldom 的 0.8.15 之前以及 0.9.12 之前的版本，以及 xmldom 0.6.0 及更早的版本中， 方法会接受无效的名称，且 ENTITY_REFERENCE_NODE 序列化器会以 的形式直接输出结果节点的 。因此，使用 并设置 直接序列化该节点或片段时，可能会破坏实体引用边界，在重新解析时产

CVSS 6.3 · Medium

Possible ATT&CK Techniques 1 AI

T1059.007 · JavaScript
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-83610

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
Source: CVE Program / CVE List V5
Vulnerability Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReference(name) accepts an invalid name and the ENTITY_REFERENCE_NODE serializer emits the resulting nodeName directly in &name; form. Directly serializing the node or fragment with XMLSerializer.serializeToString() and requireWellFormed: true can therefore break the entity-reference boundary and produce attacker-controlled XML markup when reparsed. The parser does not ordinarily create these nodes, and element-child insertion is rejected, so exploitation requires an application to create and directly serialize an EntityReference. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对输出编码和转义不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
xmldom xmldom <= 0.6.0 -
@xmldom xmldom >= 0.7.0, < 0.8.15 -

II. Public POCs for CVE-2026-83610

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-83610

请登录查看更多情报信息。

Other References for CVE-2026-83610 (7)

Same Patch Batch · xmldom · 2026-09-01 · 10 CVEs total

CVE-2026-83605 8.7 HIGH xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
CVE-2026-83606 8.7 HIGH xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructi
CVE-2026-83607 8.7 HIGH xmldom: Element name injection via createElement() bypasses requireWellFormed
CVE-2026-83609 8.7 HIGH xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line termina
CVE-2026-83613 8.7 HIGH xmldom: Quadratic-time attribute deduplication
CVE-2026-83612 8.7 HIGH xmldom: HTML raw-text closing-tag case mismatch causes output amplification
CVE-2026-83614 8.7 HIGH xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartP
CVE-2026-83608 8.7 HIGH xmldom: DocType `name` Injection Bypasses requireWellFormed
CVE-2026-83611 6.9 MEDIUM xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line

IV. Related Vulnerabilities

Same product: xmldom
Same vendor: xmldom
Same weakness: CWE-116

V. Comments for CVE-2026-83610

No comments yet

Leave a comment