xmldom: requireWellFormed DocType publicId/systemId validation is bypassable

Published September 8, 2026 CVE-2026-83618

The @xmldom/xmldom package can let an attacker alter XML an application creates. This happens when the application processes attacker-controlled document type details.

Severity
HighCVSS 4.0 · 8.7
Fix
Fixed in 0.9.12Fix recorded 2 days ago
Affected versions
0.9.10 or newer, but before 0.9.12
Weakness
CWE-91XML Injection
Exploit likelihood
0.33% in 30 daysEPSS, higher than 26% of known flaws
Affects
xmldom

How it works

  • An application must turn attacker-controlled document type identifiers into XML text.
  • The attacker supplies a valid first line followed by added markup.
  • Versions 0.9.10 and 0.9.11 inspect only the valid first line.
  • The package then writes the entire supplied value into the XML document.
  • The added markup can break into and change the surrounding XML structure.

What to do

Run npm ls --all @xmldom/xmldom inside each application folder. A reported version of 0.9.10 or 0.9.11 is affected. The 0.8.x branch and unscoped xmldom package are not affected by this advisory.

Run this in the application environment you want to check:

npm ls --all @xmldom/xmldom

Upgrade @xmldom/xmldom to version 0.9.12 through your project's normal dependency process. Verify that the resolved version is 0.9.12. Applications processing untrusted content must also use requireWellFormed: true when creating XML output.

Technical details

CVE-2026-83618 affects @xmldom/xmldom 0.9.10 and 0.9.11. Multiline matching lets a valid first line satisfy the publicId or systemId check while trailing markup remains unchecked. Version 0.9.12 checks the entire value. With requireWellFormed: true, it rejects affected identifiers containing a line terminator instead of writing them into the XML document.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure None No data disclosure
  • Vulnerable system: Data changes High Protected data can be changed with serious impact
  • Vulnerable system: Service disruption None No availability impact
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source