CVE-2026-83610 xmldom CVE debrief

Who should care

Developers and administrators using the xmldom module, especially those who create and serialize EntityReference nodes, should review and apply patches to prevent potential XML serialization vulnerabilities.

Technical summary

The xmldom module, a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer, has a vulnerability in handling EntityReference nodes during XML serialization. This could lead to the production of attacker-controlled XML markup when reparsed. The issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; however, no fixed version is available for xmldom. Exploitation requires an application to create and directly serialize an EntityReference. The parser does not ordinarily create these nodes, and element-child insertion is rejected. The vulnerability has a CVSS score of 6.3 and a severity of MEDIUM. Affected product deployments should be reviewed, and patches should be applied to prevent potential XML serialization vulnerabilities. Compensating controls should be considered for exposed systems while remediation is scheduled and verified. Monitoring and detection logs should be checked for exposed assets that need extra review. Exceptions should be tracked, and remediated assets should be retested and closed only after evidence is documented. The CVE record was published on 2026-09-01T15:17:39.107Z and has not been modified since then. The CVE Program record and the NIST NVD detail page provide additional information on this vulnerability. Developers and administrators using the xmldom module should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Asset inventory and source tracking are also recommended to address this vulnerability effectively. Rollback/change windows should be considered for remediation efforts. The debrief and evidence notes provide additional context on this issue, including its impact and potential mitigations. The issue requires a comprehensive review of the xmldom module usage and the implementation of defensive measures to prevent exploitation. The recommended actions include reviewing and applying patches, ensuring applications do not create and directly serialize EntityReference nodes, monitoring for and addressing any instances of

Defensive priority

Review and apply patches for xmldom to prevent potential XML serialization vulnerabilities.

Recommended defensive actions

• Review and apply patches for xmldom to prevent potential XML serialization vulnerabilities.
• Ensure applications do not create and directly serialize EntityReference nodes.
• Monitor for and address any instances of xmldom usage in the environment.
• Consider implementing compensating controls to detect and prevent exploitation attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE-2026-83610 issue involves a vulnerability in the xmldom module, specifically in the handling of EntityReference nodes during XML serialization. Prior to versions 0.8.15 and 0.9.12, the Document.createEntityReference(name) method accepted invalid names, and the ENTITY_REFERENCE_NODE serializer emitted the resulting nodeName directly in &name; form. This could lead to the production of attacker-controlled XML markup when reparsed. The issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; however, no fixed version is available for xmldom. Exploitation requires an application to create and directly serialize an EntityReference. The parser does not ordinarily create these nodes, and element-child insertion is rejected.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.