CVE-2026-83616: xmldom XXE Injection Vulnerability

CVE-2026-83616 Overview

CVE-2026-83616 is an XML injection vulnerability in @xmldom/xmldom, a pure JavaScript W3C standard-based DOMParser and XMLSerializer module. The flaw resides in Document.createProcessingInstruction(target, data) within lib/dom.js, which accepts an unvalidated target argument. When serialized with requireWellFormed: true, the serializer emits <?target data?> without properly validating the target string. An attacker who controls the target value can inject characters such as >, ?, whitespace, or other invalid XML-name characters to break the processing-instruction boundary and inject arbitrary XML structure into the output. The issue is categorized under [CWE-91] (XML Injection).

Critical Impact
Attackers can inject arbitrary XML structure into serialized documents, corrupting output integrity and potentially bypassing downstream XML security controls.

Affected Products

@xmldom/xmldom versions prior to 0.8.15 (0.8.x branch)
@xmldom/xmldom versions prior to 0.9.12 (0.9.x branch)
xmldom version 0.6.0 and earlier (no fix available)

Discovery Timeline

2026-09-01 - CVE-2026-83616 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-83616

Vulnerability Analysis

The vulnerability affects the serialization path for XML processing instructions. Document.createProcessingInstruction(target, data) performs no input validation on target and does not throw InvalidCharacterError as the DOM specification requires. On the 0.9.x branch, the requireWellFormed: true serializer only checks whether target contains a colon or matches the reserved case-insensitive name xml. On the 0.8.x branch, the serializer performs no target check at all. Because the serializer then emits the string <?target data?> verbatim, a crafted target that contains ?>, >, whitespace, or other characters outside the XML NCName production terminates the processing-instruction node prematurely and injects attacker-controlled markup into the surrounding document.

Root Cause

The root cause is missing enforcement of the XML NCName production for processing-instruction targets. Neither createProcessingInstruction nor the requireWellFormed serializer validates that target is a Name with no colon that is not an ASCII case-insensitive match for "xml". This gap allows structural XML characters to survive into the serialized output.

Attack Vector

Exploitation requires an application that passes untrusted input into the target parameter of createProcessingInstruction and later serializes the resulting document. The attack is remote and requires no authentication or user interaction. Downstream consumers of the serialized XML, such as SOAP endpoints, SAML processors, or configuration loaders, may then parse the injected structure as legitimate XML, enabling data tampering or logic manipulation.

javascript

// Patch excerpt from lib/dom.js — commit 1cde3e3
// Documents the new serializer contract that rejects invalid PI targets

 * Note: When the resulting document is serialized with `requireWellFormed: true`, the
 * serializer throws `InvalidStateError` if `.target` is not a valid XML `NCName` (a `Name`
 * with no colon) or is an ASCII case-insensitive match for `"xml"`, or if `.data` contains
 * `?>` or characters outside the XML Char production (W3C DOM Parsing §3.2.1.7). Without
 * that option the target and data are emitted verbatim.
 *
 * @param {string} target
 * @param {string} data

Source: GitHub Commit 1cde3e3

javascript

// Patch excerpt from lib/dom.js — commit 3b69487 (0.8.x branch)

 * Note: When the resulting document is serialized with `requireWellFormed: true`, the
 * serializer throws with code `INVALID_STATE_ERR` if `.target` is not a valid XML `NCName`
 * (a `Name` with no colon) or is an ASCII case-insensitive match for `"xml"`, or if `.data`
 * contains `?>` (W3C DOM Parsing §3.2.1.7). Without that option the target and data are
 * emitted verbatim.

Source: GitHub Commit 3b69487

Detection Methods for CVE-2026-83616

Indicators of Compromise

Serialized XML output containing processing-instruction targets with whitespace, >, ?, or non-NCName characters.
Unexpected structural XML fragments appearing adjacent to processing instructions in application logs or stored documents.
Application errors from downstream XML consumers rejecting malformed documents produced by xmldom-based services.

Detection Strategies

Perform software composition analysis (SCA) to identify @xmldom/xmldom or xmldom at vulnerable versions in package.json and package-lock.json files.
Audit application code for calls to createProcessingInstruction where the target argument is derived from external input.
Add unit tests that assert InvalidStateError is raised when constructing PIs with malformed targets under requireWellFormed: true.

Monitoring Recommendations

Log and alert on XML parsing exceptions in services that consume xmldom-serialized output.
Track dependency updates through CI/CD pipelines and flag builds pinned to xmldom@<=0.6.0, @xmldom/xmldom@<0.8.15, or @xmldom/xmldom@<0.9.12.
Review application telemetry for anomalous XML payload sizes or unexpected node counts that may indicate injection attempts.

How to Mitigate CVE-2026-83616

Immediate Actions Required

Upgrade @xmldom/xmldom to version 0.8.15 or 0.9.12 immediately, depending on the branch in use.
Replace the unmaintained xmldom package (0.6.0 and earlier) with @xmldom/xmldom at a patched version, since no fix exists for the legacy package.
Audit all invocations of createProcessingInstruction and validate target against the XML NCName production before calling.

Patch Information

The maintainers released fixes in GitHub Release 0.8.15 and GitHub Release 0.9.12. The patches are tracked in GitHub Pull Request #1071 and GitHub Pull Request #1072. Full context is provided in the GitHub Security Advisory GHSA-c7q8-3ch8-vqpv.

Workarounds

Reject or sanitize any untrusted input before passing it as the target argument to createProcessingInstruction.
Avoid emitting processing instructions built from user-controlled data; where PIs are unnecessary, remove that code path entirely.
Enforce requireWellFormed: true during serialization and treat any thrown InvalidStateError as a security signal.

bash

# Upgrade to a patched release
npm install @xmldom/xmldom@0.9.12

# Or, for the 0.8.x maintenance branch
npm install @xmldom/xmldom@0.8.15

# Verify installed version
npm ls @xmldom/xmldom