Description
An EntityReference node can be created with an invalid, attacker-controlled name through Document.createEntityReference(name). When this node is serialized directly with:
the invalid nodeName is emitted into the serialized XML fragment without validation or escaping.
This can produce real XML markup in the serialized output.
Recommendation
Update the @xmldom/xmldom package to the latest compatible version. Followings are version details:
Affected version(s): **>= 0.9.0, <= 0.9.11 >= 0.7.0, <= 0.8.14** Patched version(s): **0.9.12 0.8.15**
References
Could your website be exposed too?
SmartScanner can check your website for xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization and gives you actionable findings to investigate.
Start a free scanRelated Issues
- xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization - xmldom - CVE-2026-83610
- xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion - CVE-2026-34601
- xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the - CVE-2026-83609
- xmldom: Element name injection via createElement() bypasses requireWellFormed - CVE-2026-83607
You might also like:
See something that needs correcting? Let us knowUpdated September 02, 2026