Skip to main content

xmldom CVE-2026-83610

| EUVDEUVD-2026-69222 MEDIUM
Improper Encoding or Escaping of Output (CWE-116)
2026-09-01 GitHub_M GHSA-6gmq-8vp8-gcm6
Xmldom
6.3
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.7 LOW

AC:H reflects the specific precondition (explicit EntityReference construction from untrusted input then serialized); integrity-only impact with no confidentiality or availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
5.8 HIGH
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Sep 01, 2026 - 16:02 EUVD
Metadata Corrected
Sep 01, 2026 - 15:40 vuln.today
tag: Information Disclosure removed
Source Code Evidence Fetched
Sep 01, 2026 - 15:18 vuln.today
Analysis Generated
Sep 01, 2026 - 15:18 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 16 npm packages depend on @xmldom/xmldom (9 direct, 7 indirect)
  • 1,996 npm packages depend on xmldom (859 direct, 1,163 indirect)

Ecosystem-wide dependent count for version 0.7.0 and other introduced versions.

DescriptionCVE.org

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReference(name) accepts an invalid name and the ENTITY_REFERENCE_NODE serializer emits the resulting nodeName directly in &name; form. Directly serializing the node or fragment with XMLSerializer.serializeToString() and requireWellFormed: true can therefore break the entity-reference boundary and produce attacker-controlled XML markup when reparsed. The parser does not ordinarily create these nodes, and element-child insertion is rejected, so exploitation requires an application to create and directly serialize an EntityReference. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

AnalysisAI

XML injection via EntityReference in xmldom enables attacker-controlled XML markup to escape entity-reference boundaries when the serialized output is reparsed downstream. Applications using @xmldom/xmldom prior to 0.8.15 or 0.9.12, or any version of the legacy xmldom package (which has no fix), are affected if they explicitly call Document.createEntityReference() with attacker-supplied input and serialize the result via XMLSerializer.serializeToString(). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three simultaneous application-level conditions: (1) the application explicitly calls Document.createEntityReference() with attacker-controlled input - this API is never invoked by the xmldom parser itself during XML parsing, so the vulnerable path is entirely application-driven; (2) the resulting node or a document fragment containing it is passed to XMLSerializer.serializeToString() with the requireWellFormed: true option enabled; and (3) the serialized XML string is subsequently consumed by a downstream parser in a security-relevant context where injected XML structure has meaningful effect. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.3 Medium with AT:P (attack precondition required) accurately reflects the constrained nature of this flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patches are available: upgrade @xmldom/xmldom to 0.8.15 on the 0.8.x branch or 0.9.12 on the 0.9.x branch, confirmed by release tags at https://github.com/xmldom/xmldom/releases/tag/0.8.15 and https://github.com/xmldom/xmldom/releases/tag/0.9.12. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Xmldom

View all
CVE-2022-39353 CRITICAL POC
9.8 Nov 02

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. Rated crit
CVE-2022-37616 CRITICAL
9.8 Oct 11

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) pa
CVE-2026-83615 HIGH
8.7 Sep 01

Quadratic namespace-map allocation in xmldom's SAX parser allows unauthenticated remote attackers to exhaust the Node.js
CVE-2026-83608 HIGH
8.7 Sep 01

XML injection in the xmldom serializer allows a crafted DocumentType.name containing '>' or whitespace to prematurely cl
CVE-2026-83605 HIGH
8.7 Sep 01

XML injection in the xmldom JavaScript library allows crafted attribute names to break out of attribute context during s
CVE-2026-83613 HIGH
8.7 Sep 01

Quadratic attribute-processing complexity in xmldom's DOMParser enables remote unauthenticated denial of service against
CVE-2026-83618 HIGH
8.7 Sep 01

XML injection in @xmldom/xmldom versions 0.9.10 and 0.9.11 bypasses the requireWellFormed serializer's DocumentType vali
CVE-2026-83619 HIGH
8.7 Sep 01

ReDoS in @xmldom/xmldom versions 0.7.0 through 0.8.14 allows remote unauthenticated attackers to stall the Node.js event
CVE-2026-83617 HIGH
8.7 Sep 01

XML injection in @xmldom/xmldom 0.9.11 allows attackers who supply crafted element or attribute names containing ECMAScr
CVE-2026-83616 HIGH
8.7 Sep 01

Processing-instruction target injection in the @xmldom/xmldom JavaScript library allows XML structure breakout through u
CVE-2026-83614 HIGH
8.7 Sep 01

Two independent quadratic-complexity denial-of-service paths in the xmldom JavaScript XML parser allow remote unauthenti
CVE-2026-83612 HIGH
8.7 Sep 01

Quadratic CPU and memory exhaustion in @xmldom/xmldom 0.9.0-beta.1 through 0.9.11 allows denial-of-service via small cra

Same weakness CWE-116 – Improper Encoding or Escaping of Output

View all
CVE-2013-4547 HIGH POC
7.5
CVE-2026-20245 HIGH POC
7.8
CVE-2022-36446 CRITICAL POC
9.8
CVE-2017-8303 CRITICAL POC
9.8
CVE-2022-30781 HIGH POC
7.5
CVE-2023-46301 CRITICAL POC
9.8
CVE-2023-46300 CRITICAL POC
9.8
CVE-2022-41443 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected

Share

CVE-2026-83610 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy