Description
Document.createProcessingInstruction() in @xmldom/xmldom performs no validation on the target parameter. The requireWellFormed: true serializer option validates only for : in the target and a case-insensitive xml prefix, but does not check for > characters. A > in the target breaks the processing instruction boundary (<?...?>), allowing injection of arbitrary content into the serialized XML output.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 0.6.0
References
Could your website be exposed too?
SmartScanner can check your website for xmldom: Processing Instruction Target Injection Bypasses requireWellFormed - xmldom and gives you actionable findings to investigate.
Start a free scanRelated Issues
- xmldom: Processing Instruction Target Injection Bypasses requireWellFormed - CVE-2026-83616
- xmldom: Element name injection via createElement() bypasses requireWellFormed - CVE-2026-83607
- xmldom: Element name injection via createElement() bypasses requireWellFormed - xmldom - CVE-2026-83607
- xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed - CVE-2026-83605
You might also like:
See something that needs correcting? Let us knowUpdated September 08, 2026