Vulnerability in xmldom JavaScript Library Affects Document Parsing
CVE-2026-83610
6.3MEDIUM
What is CVE-2026-83610?
A limitation in the xmldom JavaScript library allows the Document.createEntityReference(name) method to accept invalid names. Consequently, when serializing using XMLSerializer with requireWellFormed set to true, there is a risk of creating attacker-controlled XML markup. This vulnerability requires an application to create and directly serialize an EntityReference, leading to potential security flaws during XML parsing. The issue has been addressed in @xmldom/xmldom versions 0.8.15 and 0.9.12, while no fix exists for earlier xmldom versions.
Affected Version(s)
xmldom <= 0.6.0
xmldom >= 0.7.0, < 0.8.15 < 0.7.0, 0.8.15
xmldom >= 0.9.0, < 0.9.12 < 0.9.0, 0.9.12