XML DOMParser Vulnerability in xmldom JavaScript Module
CVE-2026-83608
8.7HIGH
What is CVE-2026-83608?
The xmldom module contains a vulnerability related to the DocumentType.name property that may allow an attacker to modify the structure of an XML document. Specifically, a flaw exists in how the module processes the DOCUMENT_TYPE_NODE, which can lead to the unintended termination of the declaration. This enables the injection of sibling markup when the DocumentType.name includes certain characters, such as whitespace or >. Such manipulation could lead to significant security risks, which have been addressed in versions 0.8.15 and 0.9.12 of @xmldom/xmldom, though no fixed version is available for xmldom itself.
Affected Version(s)
xmldom <= 0.6.0
xmldom >= 0.9.0, < 0.9.12 < 0.9.0, 0.9.12
xmldom >= 0.7.0, < 0.8.15 < 0.7.0, 0.8.15