@xmldom/xmldom CVE-2026-83618

Exploitation requires all three of the following conditions simultaneously: (1) the application uses @xmldom/xmldom version 0.9.10 or 0.9.11; (2) the application calls XMLSerializer.serializeToString() with the { requireWellFormed: true } option, relying on it as a sanitization boundary; and (3) a DocumentType node whose publicId or systemId value is at least partially attacker-controlled reaches the serializer - for example, by parsing untrusted XML that includes a DOCTYPE declaration. Applications that never call the serializer with requireWellFormed: true, that do not process attacker-supplied DOCTYPE nodes, or that run a version outside the 0.9.10-0.9.11 range are not affected by this specific bypass. An additional unvalidated creation-time path exists independently: direct assignment to DocumentType.publicId and DocumentType.systemId is unvalidated by design in all versions, meaning the serializer fix does not close injection via direct property manipulation.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VI:H) reflects a worst-case attack path where an application exposes the vulnerable serialization pipeline to untrusted input with no authentication gate. Real-world risk is narrower: exploitation requires the specific conjunction of an attacker-controlled DocumentType node, the requireWellFormed: true serializer option, and a downstream consumer that acts on the serialized output - applications that never use the strict-serialization path are not exposed by this specific bypass. EPSS data is absent from the source intelligence, so exploitation probability cannot be quantified; the vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified, indicating no confirmed widespread exploitation at time of analysis. The integrity-only impact profile (VI:H, VC:N, VA:N) is consistent with XML injection: an attacker cannot directly exfiltrate data or cause crashes but can corrupt or inject into downstream XML pipelines, which carries meaningful trust-chain risk in document-processing architectures. The CVSS 4.0 base vector omits subsequent-system integrity impact (SI:N), which may understate risk in pipelines where the serialized output feeds a second XML parser or display layer.

An attacker submits an XML document containing a DOCTYPE node whose publicId begins with a syntactically valid PubidLiteral on the first line - satisfying the multiline-anchored regex - followed by a newline character and breakout markup such as a closing bracket and injected element content. The consuming application parses the document with xmldom and re-serializes it using XMLSerializer with requireWellFormed: true, relying on that option to sanitize the output; the multiline regex bypass allows the injected content to pass validation and appear verbatim in the emitted <!DOCTYPE ...> declaration. A downstream XML parser, XSLT processor, or display layer that processes the serialized string then interprets the injected markup as legitimate document structure.