XML Processing Instruction Vulnerability in xmldom by xmldom
CVE-2026-83616
8.7HIGH
What is CVE-2026-83616?
The xmldom library, a pure JavaScript module for XML parsing, contains a vulnerability in the Document.createProcessingInstruction function. Earlier versions of the library fail to validate the 'target' parameter, allowing for the inclusion of invalid XML characters such as '>', '?', and whitespace. This flaw can compromise XML structure integrity, potentially leading to unwanted data inclusion or execution of malicious commands. The issue has been addressed in versions 0.8.15 and 0.9.12 of the @xmldom/xmldom package, but no fix is available for the xmldom library itself.
Affected Version(s)
xmldom <= 0.6.0
xmldom >= 0.7.0, < 0.8.15 < 0.7.0, 0.8.15
xmldom >= 0.9.0, < 0.9.12 < 0.9.0, 0.9.12