xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

Published September 8, 2026 CVE-2026-83616

The xmldom JavaScript library lets a program build special XML tags without checking their content for a stray greater-than symbol. An attacker who controls that text can break out of the tag and slip in fake content, which a browser reading the result may treat as real code.

Severity
HighCVSS 4.0 · 8.7
Fix
Fix not establishedNo fixed release identified in this report
Affected versions
0.6.0 or older; 0.7.0 or newer, but before 0.8.15; 0.9.0 or newer, but before 0.9.12
Weakness
CWE-91XML Injection
Exploit likelihood
0.35% in 30 daysEPSS, higher than 28% of known flaws
Affects
xmldom

How it works

  • xmldom lets code create a small XML marker called a processing instruction, written as <?target data?>, and never checks what text goes into its target name.
  • A newer safety setting called requireWellFormed is meant to catch bad input, but it only rejects a colon or the word xml, not a greater-than symbol.
  • If an attacker controls that target text, adding a greater-than symbol closes the marker early.
  • Everything typed after that point then gets read as normal document content by whatever program processes the output next, including a browser if the result is served as XHTML.

What to do

Check the installed version with npm ls @xmldom/xmldom and compare it against the affected ranges: 0.7.0 through 0.8.14, or 0.9.0 through 0.9.11 for @xmldom/xmldom, or any release of the old standalone xmldom package at 0.6.0 or earlier. Risk is highest if the code ever builds a processing instruction from user-controlled text and then serializes the document. Update @xmldom/xmldom with npm install @xmldom/xmldom@0.8.15 or npm install @xmldom/xmldom@0.9.12 depending on which release line the project uses, and explicitly pass { requireWellFormed: true } to serializeToString calls, since the fix only protects that opt-in mode, not the default one. There is no fixed version for the old standalone xmldom package, so apps still on it should migrate to @xmldom/xmldom.

Run this in the application environment you want to check:

npm ls @xmldom/xmldom

Technical details

CVE-2026-83616 affects Document.createProcessingInstruction in @xmldom/xmldom, which accepts any string as a processing-instruction target without validation. The requireWellFormed serializer path only rejected a colon or a case-insensitive xml prefix, not a greater-than character, so a target containing closed the <?...? boundary early and let arbitrary content, including XHTML script elements, get injected into serialized output. The fix, in 0.8.15 and 0.9.12, validates the target as an XML NCName under requireWellFormed and throws InvalidStateError otherwise, but only when that opt-in flag is passed; the default serialization path still emits an ill-formed target verbatim. No fix exists for the legacy standalone xmldom package.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure None No data disclosure
  • Vulnerable system: Data changes High Protected data can be changed with serious impact
  • Vulnerable system: Service disruption None No availability impact
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source