Which versions of @xmldom/xmldom are affected by EUVD-2026-69239?

The @xmldom/xmldom and xmldom JavaScript libraries contain an XML processing instruction injection vulnerability (CVSS 8.7); no public exploit identified at time of analysis.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-69239?

Yes, a public proof-of-concept exploit is available for EUVD-2026-69239. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-69239?

Within 24 hours, identify all applications and dependencies using @xmldom/xmldom (versions before 0.8.15 or 0.9.12) or legacy xmldom (0.6.0 and earlier). Within 7 days, upgrade @xmldom/xmldom deployments to version 0.8.15 (for 0.8.x line) or 0.9.12 (for 0.9.x line); for legacy xmldom users, implement input validation on processing instruction targets or initiate migration to a maintained library. Complete all remediation within 30 days.

@xmldom/xmldom EUVD-2026-69239

Q: What is the CVSS score of EUVD-2026-69239?

EUVD-2026-69239 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-83616 HIGH

XML Injection (aka Blind XPath Injection) (CWE-91)

2026-09-01 GitHub_M

GHSA-c7q8-3ch8-vqpv

Xmldom

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Network-exploitable with no privileges when PI target is attacker-controlled; scope changes because injected XML can be processed by downstream systems outside the vulnerable application.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

SUSE

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 10, 2026 - 11:27 vuln.today

Patch available

Sep 01, 2026 - 16:02 EUVD

Metadata Corrected

Sep 01, 2026 - 15:40 vuln.today

tag: Information Disclosure removed

Source Code Evidence Fetched

Sep 01, 2026 - 15:25 vuln.today

Analysis Generated

Sep 01, 2026 - 15:25 vuln.today

CVE Published

Sep 01, 2026 - 14:45 cve.org

HIGH 8.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

16 npm packages depend on @xmldom/xmldom (9 direct, 7 indirect)
1,999 npm packages depend on xmldom (859 direct, 1,166 indirect)

Ecosystem-wide dependent count for version 0.7.0 and other introduced versions.

DescriptionCVE.org

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstruction(target, data) in lib/dom.js accepts an unvalidated target, while the requireWellFormed: true serializer checks only for a colon and the reserved case-insensitive xml name on 0.9.x and performs no target check on 0.8.x. Because serialization emits <?target data?>, a target containing >, ?, whitespace, or another invalid XML-name character can break the processing-instruction boundary and inject XML structure. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

AnalysisAI

Processing-instruction target injection in the @xmldom/xmldom JavaScript library allows XML structure breakout through unvalidated characters in Document.createProcessingInstruction() targets. Versions prior to 0.8.15 and 0.9.12 - and all versions of the legacy xmldom package (0.6.0 and earlier, which has no fix) - emit malformed processing instructions when a target contains >, ?, whitespace, or other XML-Name-invalid characters, enabling injection of arbitrary XML structure into the serialized output. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the target argument to Document.createProcessingInstruction() originate from or be influenced by attacker-controlled input, and that the resulting DOM be subsequently serialized via XMLSerializer.serializeToString(). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The source-provided CVSS 4.0 score of 8.7 (High) with AV:N/AC:L/AT:N/PR:N/UI:N reflects a worst-case scenario where an application passes untrusted user input directly to createProcessingInstruction(). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade @xmldom/xmldom to version 0.8.15 (https://github.com/xmldom/xmldom/releases/tag/0.8.15) or 0.9.12 (https://github.com/xmldom/xmldom/releases/tag/0.9.12) depending on the branch in use; both releases are confirmed by GitHub release tags and the associated PR commits (https://github.com/xmldom/xmldom/commit/1cde3e31a07c41c87cfd368d6946aa477f16b4f9 and https://github.com/xmldom/xmldom/commit/3b694872bcb5c7e3cbadba961a4be2488750ce5b). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all applications and dependencies using @xmldom/xmldom (versions before 0.8.15 or 0.9.12) or legacy xmldom (0.6.0 and earlier). …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Xmldom

View all

CVE-2022-39353 CRITICAL Act Now POC

9.8 Nov 02

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. Rated crit

CVE-2026-83610 MEDIUM This Month POC

6.3 Sep 01

XML injection via EntityReference in xmldom enables attacker-controlled XML markup to escape entity-reference boundaries

CVE-2022-37616 CRITICAL Act Now

9.8 Oct 11

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) pa

CVE-2026-83615 HIGH This Week POC

8.7 Sep 01

Quadratic namespace-map allocation in xmldom's SAX parser allows unauthenticated remote attackers to exhaust the Node.js

CVE-2026-83614 HIGH This Week POC

8.7 Sep 01

Two independent quadratic-complexity denial-of-service paths in the xmldom JavaScript XML parser allow remote unauthenti

CVE-2026-83608 HIGH This Week POC

8.7 Sep 01

XML injection in the xmldom serializer allows a crafted DocumentType.name containing '>' or whitespace to prematurely cl

CVE-2026-83607 HIGH This Week POC

8.7 Sep 01

XML injection and cross-site scripting in the xmldom JavaScript library allows attacker-controlled tag names to be injec

CVE-2026-83605 HIGH This Week POC

8.7 Sep 01

XML injection in the xmldom JavaScript library allows crafted attribute names to break out of attribute context during s

CVE-2026-83613 HIGH This Week POC

8.7 Sep 01

Quadratic attribute-processing complexity in xmldom's DOMParser enables remote unauthenticated denial of service against

CVE-2026-83618 HIGH This Week POC

8.7 Sep 01

XML injection in @xmldom/xmldom versions 0.9.10 and 0.9.11 bypasses the requireWellFormed serializer's DocumentType vali

CVE-2026-83617 HIGH This Week POC

8.7 Sep 01

XML injection in @xmldom/xmldom 0.9.11 allows attackers who supply crafted element or attribute names containing ECMAScr

CVE-2026-83609 HIGH This Week POC

8.7 Sep 01

XML injection in @xmldom/xmldom 0.9.0-0.9.11 allows an attacker to embed malicious markup into serialized XML output by

Same weakness CWE-91 – XML Injection (aka Blind XPath Injection)

View all

CVE-2020-0646 CRITICAL POC

9.8

CVE-2023-46214 HIGH POC

8.8

CVE-2023-27253 HIGH POC

8.8

CVE-2013-7429 CRITICAL POC

9.8

CVE-2023-43187 CRITICAL POC

9.8

CVE-2019-17626 CRITICAL POC

9.8

CVE-2019-16941 CRITICAL POC

9.8

CVE-2019-14277 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Module for Python 3 15 SP7	Not-Affected
SUSE Linux Enterprise Server 15 SP7	Not-Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected

EUVD-2026-69239 vulnerability details – vuln.today

Back

@xmldom/xmldom EUVD-2026-69239

Severity by source

CVSS VectorVendor: GitHub_M

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More in Xmldom

Same weakness CWE-91 – XML Injection (aka Blind XPath Injection)

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code