CVE-2026-83610: xmldom XXE Vulnerability in JavaScript

CVE-2026-83610 Overview

CVE-2026-83610 is an XML injection vulnerability in the @xmldom/xmldom package, a pure JavaScript W3C-standard DOMParser and XMLSerializer module. The flaw resides in Document.createEntityReference(name), which accepts an invalid name argument. The ENTITY_REFERENCE_NODE serializer then emits the resulting nodeName verbatim in &name; form. When applications call XMLSerializer.serializeToString() with requireWellFormed: true, an attacker-controlled name can break the entity-reference boundary and inject arbitrary XML markup upon reparsing. The issue is classified as improper output encoding [CWE-116] and affects @xmldom/xmldom before 0.8.15 and 0.9.12, and all versions of the legacy xmldom package (0.6.0 and earlier).

Critical Impact
An attacker who controls the name argument passed to createEntityReference can inject arbitrary XML markup into the serialized output, corrupting downstream XML consumers.

Affected Products

@xmldom/xmldom versions prior to 0.8.15
@xmldom/xmldom versions prior to 0.9.12
xmldom version 0.6.0 and earlier (unmaintained, no fix available)

Discovery Timeline

2026-09-01 - CVE-2026-83610 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-83610

Vulnerability Analysis

The vulnerability stems from insufficient validation of the name parameter in Document.createEntityReference. The pre-patch implementation used a non-anchored regular expression (g.Name.test(name)) to validate the argument. This allowed strings containing valid XML Name characters as a substring while permitting additional injection payloads elsewhere in the input. The EntityReference serializer then wrote the stored nodeName directly between & and ; without escaping. An attacker able to control the name parameter can therefore emit arbitrary markup, such as &valid;<script>malicious</script>;, into the serialized XML. Reparsing this output produces attacker-controlled elements or attributes, subverting the entity-reference boundary. Exploitation requires the host application to both construct an EntityReference node and directly serialize it, so the vulnerability is not reachable through parsing alone.

Root Cause

The root cause is improper output neutralization [CWE-116] combined with weak input validation. The g.Name regular expression matched any string containing a valid XML Name substring rather than validating the entire string. The nodeName was stored verbatim and emitted verbatim by the serializer, with no escaping and no re-validation at serialization time.

Attack Vector

Exploitation requires an application that (1) accepts untrusted input as the argument to Document.createEntityReference, and (2) serializes the resulting node or a fragment containing it using XMLSerializer.serializeToString(). The parser itself does not construct EntityReference nodes, and element-child insertion is rejected, so purely parser-driven exploitation is not possible.

javascript

// Vulnerable code path (pre-patch) in lib/dom.js
createEntityReference: function (name) {
    if (!g.Name.test(name)) {  // non-anchored: matches substrings
        throw new DOMException(DOMException.INVALID_CHARACTER_ERR,
            'not a valid xml name "' + name + '"');
    }
    // nodeName stored verbatim; serializer emits &nodeName; without escaping
}

// Fixed code path uses anchored Name_exact / tagNamePattern
if (!g.Name_exact.test(name)) {
    throw new DOMException(DOMException.INVALID_CHARACTER_ERR,
        'not a valid xml name "' + name + '"');
}

Source: GitHub Commit 4664386e

Detection Methods for CVE-2026-83610

Indicators of Compromise

Serialized XML output containing unexpected markup between & and ; delimiters, such as &name<tag>; sequences.
Application logs recording DOMException throws from createEntityReference after the patch is applied, indicating rejected malicious input.
Downstream XML consumers reporting parse errors or unexpected element trees originating from serialized xmldom output.

Detection Strategies

Perform Software Composition Analysis (SCA) to identify dependencies on @xmldom/xmldom below 0.8.15 or 0.9.12, or on the legacy xmldom package at any version.
Static code analysis for calls to Document.createEntityReference where the name argument is sourced from untrusted input such as HTTP parameters, message bodies, or database fields.
Runtime instrumentation to log arguments passed to createEntityReference and flag inputs that contain characters outside the XML Name production.

Monitoring Recommendations

Monitor Node.js application logs for INVALID_CHARACTER_ERR and InvalidStateError exceptions originating from xmldom serialization paths.
Track dependency manifests (package.json, package-lock.json, yarn.lock) in source control for pinned vulnerable versions of xmldom.
Alert on outbound XML payloads containing malformed entity references or unexpected nested markup.

How to Mitigate CVE-2026-83610

Immediate Actions Required

Upgrade @xmldom/xmldom to version 0.8.15 or 0.9.12 or later across all Node.js projects and container images.
Remove the legacy unmaintained xmldom package and migrate to @xmldom/xmldom, since no fix is available for xmldom.
Audit application code for direct callers of Document.createEntityReference and ensure the name argument is never sourced from untrusted input.

Patch Information

The fix, published under advisory GHSA-6gmq-8vp8-gcm6, replaces the non-anchored g.Name regular expression with the anchored g.Name_exact (0.9.x) or tagNamePattern (0.8.x). The serializer, when invoked with requireWellFormed: true, additionally re-validates nodeName and throws InvalidStateError on mutation. See the 0.8.15 release, 0.9.12 release, Pull Request #1071, and Pull Request #1072.

Workarounds

Avoid calling Document.createEntityReference with any input that is not statically defined by the application.
If createEntityReference must be called with dynamic input, validate the name against the anchored XML Name production before invocation.
Always pass requireWellFormed: true to XMLSerializer.serializeToString() on patched versions to enforce serializer-side validation.

bash

# Upgrade to patched versions
npm install @xmldom/xmldom@^0.9.12
# or, for the 0.8.x line
npm install @xmldom/xmldom@^0.8.15

# Audit for the unmaintained legacy package
npm ls xmldom