XML Injection Vulnerability in @xmldom/xmldom via Processing Instruction Targets

The @xmldom/xmldom library is susceptible to an XML injection vulnerability (CVE-2026-83616) due to insufficient validation of the target parameter in the Document.createProcessingInstruction() method. When developers use the requireWellFormed: true option in XMLSerializer.serializeToString(), the library fails to properly sanitize the processing instruction (PI) target. Specifically, it does not check for the > character, which prematurely terminates the processing instruction (<?target data?>).

An attacker controlling the input to the target parameter can inject arbitrary XML elements, including <script> tags, into the serialized output. If this output is subsequently served as XHTML or processed by a downstream XML parser, it may lead to Cross-Site Scripting (XSS) or XML External Entity (XXE) injection attacks. The protection is not enabled by default, requiring developers to explicitly opt-in to the requireWellFormed mode, which remains incomplete in its validation logic across various versions of the library.

Impact

Successful exploitation allows for the injection of arbitrary XML structure, leading to potential XSS in browser-based applications and XXE vulnerabilities in backend XML parsers. Impact is localized to applications that generate XML dynamically using user-provided data without sufficient secondary validation.

Recommendation

• Upgrade to a non-vulnerable version of @xmldom/xmldom as soon as updates are available.
• Audit all serializeToString() call sites to ensure requireWellFormed: true is explicitly enabled for any serialization of untrusted or user-influenced DOM content.
• Implement strict input validation on any string used as a processing instruction target, ensuring it conforms strictly to the XML NCName production (no colons, whitespace, or XML-reserved characters like > or ?).
• Do not rely on requireWellFormed: true as the sole mitigation for untrusted input, as it is an opt-in configuration that may not catch all malicious injection vectors.