@xmldom/xmldom CVE-2026-83616

Exploitation requires that the target argument to Document.createProcessingInstruction() originate from or be influenced by attacker-controlled input, and that the resulting DOM be subsequently serialized via XMLSerializer.serializeToString(). On @xmldom/xmldom 0.9.x, enabling requireWellFormed: true in the serializer provides partial protection - it rejects colons and the reserved 'xml' prefix - but does not reject >, ?, or whitespace characters in the target, leaving those injection vectors open even when this option is active. On @xmldom/xmldom 0.8.x and all versions of the legacy xmldom package, no validation occurs at any layer regardless of serializer options. Applications that determine PI targets exclusively from internal, trusted values are not exploitable. Whether authentication is required depends entirely on whether the vulnerable code path is reachable through an unauthenticated network endpoint, which is application-specific; the CVSS PR:N reflects the library-level assumption that no privilege is needed to supply input.

The source-provided CVSS 4.0 score of 8.7 (High) with AV:N/AC:L/AT:N/PR:N/UI:N reflects a worst-case scenario where an application passes untrusted user input directly to createProcessingInstruction(). In practice, real-world risk is strongly gated by application design: exploitation only occurs when the PI target derives from external input and the resulting DOM is serialized, a pattern that is specific rather than universal. VI:H (high integrity impact on the vulnerable system's output document) is credible; downstream XML processors consuming that output could also be affected, warranting SI:H consideration. No EPSS score was provided, and this CVE is absent from the CISA KEV catalog, so exploitation probability and active exploitation status are unconfirmed from the available data. The legacy xmldom package has no fix at all, meaning organizations still running it face indefinite exposure - a more urgent signal than the CVSS score alone conveys. Overall, this warrants prioritized dependency auditing with the urgency calibrated against whether the application actually passes external data to createProcessingInstruction().

An attacker submits a crafted string - for example 'foo>injected' - through a web endpoint whose backend passes the value as the target argument to Document.createProcessingInstruction(). The serializer emits <?foo>injected data?>, breaking the PI boundary and embedding an injected element into the output document. If that serialized XML is forwarded to a downstream processor such as an XSLT engine, an XML-based message bus, or an audit-logging pipeline, the injected structure is parsed as legitimate XML and may alter document semantics, bypass schema validation, or trigger unexpected parser behavior.