CVE-2026-83608 xmldom CVE debrief

Who should care

Defenders responsible for JavaScript applications using the xmldom library should assess exposure and prioritize upgrading to fixed versions. This includes reviewing the library's usage in their applications, identifying potentially affected systems, and planning for upgrades or mitigations. Additionally, defenders should monitor for potential security issues related to XML injection and review system logs for suspicious activity.

Why it matters

CVE-2026-83608 is a high-severity vulnerability in the xmldom library that allows for XML injection, potentially leading to security issues. Defenders should prioritize upgrading to fixed versions and monitoring for potential security issues.

• Potential security issues due to XML injection
• Need to verify and upgrade to fixed versions of @xmldom/xmldom or xmldom
• Monitoring for potential security issues related to XML injection

Technical summary

The xmldom library is vulnerable to XML injection through the createDocumentType() function or direct DocumentType.name property write. This can be exploited to inject sibling markup. The vulnerability is caused by the permissive validation of publicId, systemId, and internalSubset in the DOCUMENT_TYPE_NODE branch in lib/dom.js. The issue can be exploited through the createDocumentType() function or direct DocumentType.name property write, potentially leading to security issues. Defenders should prioritize upgrading to fixed versions of @xmldom/xmldom (0.8.15 or 0.9.12) or xmldom (for versions 0.6.0 and earlier) to prevent potential security issues.

Defensive priority

Defenders should prioritize upgrading to fixed versions of @xmldom/xmldom (0.8.15 or 0.9.12) or xmldom (for versions 0.6.0 and earlier) to prevent potential security issues.

Recommended defensive actions

• Upgrade to @xmldom/xmldom version 0.8.15 or 0.9.12
• Review and update xmldom versions 0.6.0 and earlier
• Monitor for potential security issues related to XML injection
• Perform vulnerability scanning to identify potentially affected systems
• Review system logs for suspicious activity related to XML injection
• Implement additional security controls to mitigate potential impacts
• Track remediation progress and verify fixes

Evidence notes

The vulnerability is caused by the permissive validation of publicId, systemId, and internalSubset in the DOCUMENT_TYPE_NODE branch in lib/dom.js. The issue can be exploited through the createDocumentType() function or direct DocumentType.name property write.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.