EUVD-2026-69219Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via untrusted DocumentType.name input; integrity-only impact on serialized output; no authentication required on the injection path itself.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENT_TYPE_NODE branch in lib/dom.js validates publicId, systemId, and internalSubset under requireWellFormed: true but emits DocumentType.name verbatim. A name containing > or whitespace can terminate the <!DOCTYPE ...> declaration and inject sibling markup; the value can be supplied through createDocumentType() on the 0.8.x and unscoped lines or through a direct DocumentType.name property write on every affected line. The default path and legacy creation-time behavior remain permissive, while the vulnerable strict path fails to enforce an XML Name. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.
AnalysisAI
XML injection in the xmldom serializer allows a crafted DocumentType.name containing '>' or whitespace to prematurely close the <!DOCTYPE ...> declaration and inject arbitrary sibling markup into serialized XML output. The gap exists because XMLSerializer.serializeToString() under requireWellFormed: true validates publicId, systemId, and internalSubset but emits DocumentType.name verbatim, violating the XML Name production consistently enforced for the other fields. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that attacker-controlled data reaches the DocumentType.name field - via createDocumentType() (accessible on the 0.8.x and unscoped xmldom lines) or via direct DocumentType.name property assignment (on every affected version) - and that the document is subsequently serialized. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VI:H) reflects a worst-case scenario where attacker-controlled data flows directly into DocumentType.name without sanitization - plausible in XML processing pipelines or API endpoints that accept and re-serialize external documents. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade @xmldom/xmldom to version 0.8.15 (0.8.x line) or 0.9.12 (0.9.x line), available at https://github.com/xmldom/xmldom/releases/tag/0.8.15 and https://github.com/xmldom/xmldom/releases/tag/0.9.12, corresponding to fix commits 57aec90ac57b4408ae7c5d1746bf2a693b5ed90e and 85f12eb4d14b44de33216cfb72b50af4d24e9fdd. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all affected dependencies: scan your entire codebase and build configurations using 'npm list xmldom' and 'npm list @xmldom/xmldom' to locate affected package versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. Rated crit
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) pa
ReDoS in @xmldom/xmldom versions 0.7.0 through 0.8.14 allows remote unauthenticated attackers to stall the Node.js event
XML injection in @xmldom/xmldom versions 0.9.10 and 0.9.11 bypasses the requireWellFormed serializer's DocumentType vali
XML injection in @xmldom/xmldom 0.9.11 allows attackers who supply crafted element or attribute names containing ECMAScr
Processing-instruction target injection in the @xmldom/xmldom JavaScript library allows XML structure breakout through u
Quadratic namespace-map allocation in xmldom's SAX parser allows unauthenticated remote attackers to exhaust the Node.js
Two independent quadratic-complexity denial-of-service paths in the xmldom JavaScript XML parser allow remote unauthenti
Quadratic attribute-processing complexity in xmldom's DOMParser enables remote unauthenticated denial of service against
Quadratic CPU and memory exhaustion in @xmldom/xmldom 0.9.0-beta.1 through 0.9.11 allows denial-of-service via small cra
XML injection in @xmldom/xmldom 0.9.0-0.9.11 allows an attacker to embed malicious markup into serialized XML output by
XML injection and cross-site scripting in the xmldom JavaScript library allows attacker-controlled tag names to be injec
Same weakness CWE-91 – XML Injection (aka Blind XPath Injection)
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today