Which versions of xmldom are affected by EUVD-2026-69219?

A critical XML injection vulnerability in xmldom serializer allows attackers to inject arbitrary XML markup into serialized output by crafting malicious DocumentType declarations, with no public…. A patch is available.

How to fix or mitigate EUVD-2026-69219?

Within 24 hours, identify all affected dependencies: scan your entire codebase and build configurations using 'npm list xmldom' and 'npm list @xmldom/xmldom' to locate affected package versions. Within 7 days, upgrade all @xmldom/xmldom instances to version 0.8.15 (for 0.8.x line) or 0.9.12 (for 0.9.x line) or later, and create a remediation plan for legacy xmldom usage. Within 30 days, complete replacement of all legacy xmldom (0.6.0 and earlier) with either patched versions of @xmldom/xmldom or an alternative XML library, then deploy to all production environments.

xmldom EUVD-2026-69219

Q: What is the CVSS score of EUVD-2026-69219?

EUVD-2026-69219 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-83608 HIGH

XML Injection (aka Blind XPath Injection) (CWE-91)

2026-09-01 GitHub_M

Code Injection Xmldom

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable via untrusted DocumentType.name input; integrity-only impact on serialized output; no authentication required on the injection path itself.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Red Hat

3.1 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Sep 01, 2026 - 16:02 EUVD

Source Code Evidence Fetched

Sep 01, 2026 - 15:11 vuln.today

Analysis Generated

Sep 01, 2026 - 15:11 vuln.today

CVE Published

Sep 01, 2026 - 14:27 cve.org

HIGH 8.7

DescriptionCVE.org

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENT_TYPE_NODE branch in lib/dom.js validates publicId, systemId, and internalSubset under requireWellFormed: true but emits DocumentType.name verbatim. A name containing > or whitespace can terminate the <!DOCTYPE ...> declaration and inject sibling markup; the value can be supplied through createDocumentType() on the 0.8.x and unscoped lines or through a direct DocumentType.name property write on every affected line. The default path and legacy creation-time behavior remain permissive, while the vulnerable strict path fails to enforce an XML Name. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

AnalysisAI

XML injection in the xmldom serializer allows a crafted DocumentType.name containing '>' or whitespace to prematurely close the <!DOCTYPE ...> declaration and inject arbitrary sibling markup into serialized XML output. The gap exists because XMLSerializer.serializeToString() under requireWellFormed: true validates publicId, systemId, and internalSubset but emits DocumentType.name verbatim, violating the XML Name production consistently enforced for the other fields. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires that attacker-controlled data reaches the DocumentType.name field - via createDocumentType() (accessible on the 0.8.x and unscoped xmldom lines) or via direct DocumentType.name property assignment (on every affected version) - and that the document is subsequently serialized. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VI:H) reflects a worst-case scenario where attacker-controlled data flows directly into DocumentType.name without sanitization - plausible in XML processing pipelines or API endpoints that accept and re-serialize external documents. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade @xmldom/xmldom to version 0.8.15 (0.8.x line) or 0.9.12 (0.9.x line), available at https://github.com/xmldom/xmldom/releases/tag/0.8.15 and https://github.com/xmldom/xmldom/releases/tag/0.9.12, corresponding to fix commits 57aec90ac57b4408ae7c5d1746bf2a693b5ed90e and 85f12eb4d14b44de33216cfb72b50af4d24e9fdd. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all affected dependencies: scan your entire codebase and build configurations using 'npm list xmldom' and 'npm list @xmldom/xmldom' to locate affected package versions. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Xmldom

View all

CVE-2022-39353 CRITICAL Act Now POC

9.8 Nov 02

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. Rated crit

CVE-2026-83610 MEDIUM This Month POC

6.3 Sep 01

XML injection via EntityReference in xmldom enables attacker-controlled XML markup to escape entity-reference boundaries

CVE-2022-37616 CRITICAL Act Now

9.8 Oct 11

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) pa

CVE-2026-83615 HIGH This Week

8.7 Sep 01

Quadratic namespace-map allocation in xmldom's SAX parser allows unauthenticated remote attackers to exhaust the Node.js

CVE-2026-83605 HIGH This Week

8.7 Sep 01

XML injection in the xmldom JavaScript library allows crafted attribute names to break out of attribute context during s

CVE-2026-83613 HIGH This Week

8.7 Sep 01

Quadratic attribute-processing complexity in xmldom's DOMParser enables remote unauthenticated denial of service against

CVE-2026-83618 HIGH This Week

8.7 Sep 01

XML injection in @xmldom/xmldom versions 0.9.10 and 0.9.11 bypasses the requireWellFormed serializer's DocumentType vali

CVE-2026-83619 HIGH This Week

8.7 Sep 01

ReDoS in @xmldom/xmldom versions 0.7.0 through 0.8.14 allows remote unauthenticated attackers to stall the Node.js event

CVE-2026-83617 HIGH This Week

8.7 Sep 01

XML injection in @xmldom/xmldom 0.9.11 allows attackers who supply crafted element or attribute names containing ECMAScr

CVE-2026-83616 HIGH This Week

8.7 Sep 01

Processing-instruction target injection in the @xmldom/xmldom JavaScript library allows XML structure breakout through u

CVE-2026-83614 HIGH This Week

8.7 Sep 01

Two independent quadratic-complexity denial-of-service paths in the xmldom JavaScript XML parser allow remote unauthenti

CVE-2026-83612 HIGH This Week

8.7 Sep 01

Quadratic CPU and memory exhaustion in @xmldom/xmldom 0.9.0-beta.1 through 0.9.11 allows denial-of-service via small cra

Same weakness CWE-91 – XML Injection (aka Blind XPath Injection)

View all

CVE-2020-0646 CRITICAL POC

9.8

CVE-2023-46214 HIGH POC

8.8

CVE-2023-27253 HIGH POC

8.8

CVE-2013-7429 CRITICAL POC

9.8

CVE-2023-43187 CRITICAL POC

9.8

CVE-2019-17626 CRITICAL POC

9.8

CVE-2019-16941 CRITICAL POC

9.8

CVE-2019-14277 CRITICAL POC

9.8

Same technique Code Injection

View all

CVE-2023-3519 CRITICAL POC

9.8

CVE-2021-22205 CRITICAL POC

10.0

CVE-2024-23692 CRITICAL POC

9.8

CVE-2012-0158 HIGH POC

8.8

CVE-2021-44529 CRITICAL POC

9.8

CVE-2014-6287 CRITICAL POC

9.8

CVE-2017-7494 CRITICAL POC

9.8

CVE-2025-24893 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Module for Python 3 15 SP7	Not-Affected
SUSE Linux Enterprise Server 15 SP7	Not-Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected

EUVD-2026-69219 vulnerability details – vuln.today

Back

xmldom EUVD-2026-69219

Severity by source

CVSS VectorVendor: GitHub_M

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More in Xmldom

Same weakness CWE-91 – XML Injection (aka Blind XPath Injection)

Same technique Code Injection

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code