CVE-2026-83618 xmldom CVE debrief

Who should care

Developers and administrators using xmldom versions 0.9.10 to 0.9.11 should be aware of this vulnerability and take immediate action to patch their systems. Affected systems should be identified and patched with version 0.9.12 of @xmldom/xmldom. Security teams should review system configurations and update to version 0.9.12. Operators and platform administrators should verify system configurations and update to version 0.9.12.

Technical summary

The xmldom module, a pure JavaScript implementation of the W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer, is vulnerable to a DocumentType injection attack. Versions 0.9.10 to 0.9.11 are affected. An attacker can bypass the strict-serialization mitigation for earlier DocumentType injection advisories by including U+000A, U+000D, U+2028, or U+2029 characters in the DocumentType.publicId and DocumentType.systemId fields. This issue is fixed in @xmldom/xmldom version 0.9.12, which validates these fields properly.

Defensive priority

High-priority defensive actions are required due to the HIGH CVSS score of 8.7. Affected systems should be identified and patched with version 0.9.12 of @xmldom/xmldom.

Recommended defensive actions

• Identify and inventory all systems using xmldom versions 0.9.10 to 0.9.11.
• Apply the patch by updating to version 0.9.12 of @xmldom/xmldom.
• Monitor for potential exploitation attempts.
• Review and update security controls to prevent similar attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE Program and NVD indicate that xmldom versions 0.9.10 to 0.9.12 are vulnerable to a DocumentType injection attack. The fix is included in version 0.9.12 of @xmldom/xmldom. Evidence limits suggest that affected scope and impact may be broader, but additional details are not provided. Defenders should verify system configurations and update to version 0.9.12.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.