Description
An EntityReference node can be created with an invalid, attacker-controlled name through Document.createEntityReference(name). When this node is serialized directly with:
the invalid nodeName is emitted into the serialized XML fragment without validation or escaping.
This can produce real XML markup in the serialized output.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 0.6.0
References
Could your website be exposed too?
SmartScanner can check your website for xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization - xmldom and gives you actionable findings to investigate.
Start a free scanRelated Issues
- xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization - CVE-2026-83610
- xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion - CVE-2026-34601
- xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion - xmldom - CVE-2026-34601
- xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed - xmldom - CVE-2026-83605
You might also like:
See something that needs correcting? Let us knowUpdated September 02, 2026