xmldom: DocType `name` Injection Bypasses requireWellFormed

Published September 8, 2026 CVE-2026-83608

A code library called xmldom, used inside many JavaScript programs to build and output XML files, can be tricked into inserting extra fake markup into that output. A safety switch developers turned on to stop this exact kind of trick does not actually block it.

Severity
HighCVSS 4.0 · 8.7
Fix
Update availableFix recorded 2 days ago
Affected versions
0.6.0 or older; 0.9.0 or newer, but before 0.9.12; 0.7.0 or newer, but before 0.8.15
Weakness
CWE-91XML Injection
Exploit likelihood
0.35% in 30 daysEPSS, higher than 28% of known flaws
Affects
xmldom

How it works

  • A program using xmldom can create an XML document type declaration and set its internal name value from data that traces back to an attacker. xmldom's output writer does not check that name for special characters before printing it.
  • If the name contains a closing bracket or a space, the printed document type line ends early.
  • Everything after that point becomes new, separate content inside the finished XML output.
  • Developers were told to turn on a strict output check called requireWellFormed to stop this kind of trick, but that check only looks at three other fields and skips the name field entirely, so it lets this exact case through.

What to do

Check which xmldom package and version your Node.js project uses with npm ls xmldom @xmldom/xmldom. If it shows @xmldom/xmldom between 0.7.0 and 0.8.14, or between 0.9.0 and 0.9.11, or any version of the plain xmldom package, your project is on an affected line. You are only actually exposed if your code lets outside input reach an XML document type name and then serializes that document, so review any code that builds document type declarations from user-supplied or external data.

Run this in the application environment you want to check:

npm ls xmldom @xmldom/xmldom

Update to @xmldom/xmldom version 0.8.15 or 0.9.12, whichever release line your project uses. There is no fixed version for the older unscoped xmldom package, so projects still on that name should move to the maintained @xmldom/xmldom package. The new check only runs if your code explicitly passes { requireWellFormed: true } when calling serializeToString, so after updating, add that option everywhere your code turns XML documents into text, and make sure any document type name your code sets never comes directly from untrusted input. See the GitHub security advisory for full detail.

Technical details

xmldom: DocType name Injection Bypasses requireWellFormed. The @xmldom/xmldom serializer emits DocumentType.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure None No data disclosure
  • Vulnerable system: Data changes High Protected data can be changed with serious impact
  • Vulnerable system: Service disruption None No availability impact
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source