{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/@xmldom/xmldom-0.9.0---0.9.11/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:xmldom:xmldom:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"id":"CVE-2026-83616"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@xmldom/xmldom (\u003c= 0.8.14)","@xmldom/xmldom (0.9.0 - 0.9.11)","xmldom (\u003c= 0.6.0)"],"_cs_severities":["high"],"_cs_tags":["injection","xss","xxe","vulnerability"],"_cs_type":"advisory","_cs_vendors":["xmldom"],"content_html":"\u003cp\u003eThe @xmldom/xmldom library is susceptible to an XML injection vulnerability (CVE-2026-83616) due to insufficient validation of the target parameter in the \u003ccode\u003eDocument.createProcessingInstruction()\u003c/code\u003e method. When developers use the \u003ccode\u003erequireWellFormed: true\u003c/code\u003e option in \u003ccode\u003eXMLSerializer.serializeToString()\u003c/code\u003e, the library fails to properly sanitize the processing instruction (PI) target. Specifically, it does not check for the \u003ccode\u003e\u0026gt;\u003c/code\u003e character, which prematurely terminates the processing instruction (\u003ccode\u003e\u0026lt;?target data?\u0026gt;\u003c/code\u003e).\u003c/p\u003e\n\u003cp\u003eAn attacker controlling the input to the target parameter can inject arbitrary XML elements, including \u003ccode\u003e\u0026lt;script\u0026gt;\u003c/code\u003e tags, into the serialized output. If this output is subsequently served as XHTML or processed by a downstream XML parser, it may lead to Cross-Site Scripting (XSS) or XML External Entity (XXE) injection attacks. The protection is not enabled by default, requiring developers to explicitly opt-in to the \u003ccode\u003erequireWellFormed\u003c/code\u003e mode, which remains incomplete in its validation logic across various versions of the library.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the injection of arbitrary XML structure, leading to potential XSS in browser-based applications and XXE vulnerabilities in backend XML parsers. Impact is localized to applications that generate XML dynamically using user-provided data without sufficient secondary validation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to a non-vulnerable version of @xmldom/xmldom as soon as updates are available.\u003c/li\u003e\n\u003cli\u003eAudit all \u003ccode\u003eserializeToString()\u003c/code\u003e call sites to ensure \u003ccode\u003erequireWellFormed: true\u003c/code\u003e is explicitly enabled for any serialization of untrusted or user-influenced DOM content.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation on any string used as a processing instruction target, ensuring it conforms strictly to the XML \u003ccode\u003eNCName\u003c/code\u003e production (no colons, whitespace, or XML-reserved characters like \u003ccode\u003e\u0026gt;\u003c/code\u003e or \u003ccode\u003e?\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eDo not rely on \u003ccode\u003erequireWellFormed: true\u003c/code\u003e as the sole mitigation for untrusted input, as it is an opt-in configuration that may not catch all malicious injection vectors.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-08T21:50:39Z","date_published":"2026-09-08T21:50:39Z","id":"https://feed.craftedsignal.io/briefs/2026-09-xmldom-injection/","summary":"The @xmldom/xmldom library fails to validate the target parameter in createProcessingInstruction, enabling attackers to break out of XML processing instructions and inject arbitrary content when serializing with the requireWellFormed flag.","title":"XML Injection Vulnerability in @xmldom/xmldom via Processing Instruction Targets","url":"https://feed.craftedsignal.io/briefs/2026-09-xmldom-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - @Xmldom/Xmldom (0.9.0 - 0.9.11)","version":"https://jsonfeed.org/version/1.1"}