XML DOMParser and XMLSerializer Vulnerability in xmldom by xmldom
CVE-2026-83618
8.7HIGH
What is CVE-2026-83618?
The xmldom module, which implements a JavaScript-based XML DOM parser and serializer, contains an input validation vulnerability affecting versions 0.9.10 to 0.9.12. Specifically, the serializer with the requireWellFormed option set to true fails to properly validate the DocumentType.publicId and DocumentType.systemId, allowing certain literal matches to bypass required formatting checks. This can lead to unvalidated markup in the emitted declaration, potentially enabling DocumentType injection vulnerabilities. The issue has been rectified in version 0.9.12.
Affected Version(s)
xmldom >= 0.9.10, < 0.9.12
xmldom >= 0.9.10, < 0.9.12