CVE-2026-83616
published 2026-09-01CVE-2026-83616: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12…
PriorityP353high8.7CVSS 4.0
AVNACLATNPRNUINVCNVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.61%
48.6th percentile
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstruction(target, data) in lib/dom.js accepts an unvalidated target, while the requireWellFormed: true serializer checks only for a colon and the reserved case-insensitive xml name on 0.9.x and performs no target check on 0.8.x. Because serialization emits , a target containing >, ?, whitespace, or another invalid XML-name character can break the processing-instruction boundary and inject XML structure. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openshift4 | ose-console | — | — |
| xmldom | xmldom | <= 0.6.0 | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | 0 – 0.6.0 | — |
| xmldom | xmldom | >= 0.7.0 < 0.8.15 | 0.8.15 |
| xmldom | xmldom | >= 0.9.0 < 0.9.12 | 0.9.12 |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
ghsa·2026-09-08
CVE-2026-83616 [HIGH] CWE-91 xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
## Summary
`Document.createProcessingInstruction()` in `@xmldom/xmldom` performs no validation on the `target` parameter. The `requireWellFormed: true` serializer option validates only for `:` in the target and a case-insensitive `xml` prefix, but does not check for `>` characters. A `>` in the target breaks the processing instruction boundary (``), allowing injection of arbitrary content into the serialized XML output.
## Details
`Document.createProcessingInstruction(target, data)` at `lib/dom.js` around line 2413 accepts any string as the `target` parameter and stores it on the PI node without validation.
During serialization, the `requireWellFormed` code path (around line 3286) performs two checks on PI targ
Red Hat
xmldom: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets
vendor_redhat·2026-09-01·CVSS 8.7
CVE-2026-83616 [HIGH] CWE-91 xmldom: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets
xmldom: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets
A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. An attacker can exploit a vulnerability in how processing instructions are handled to inject arbitrary XML structures. This occurs because the software fails to properly validate input, allowing special characters to bypass security checks. Successful exploitation could lead to data manipulation or other integrity impacts within applications processing the affected XML.
Package: openshift4/ose-console (Red Hat OpenShift Container Platform 4) - Affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-83616 mathjax3: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [fedora-all]
bugzilla·2026-09-03·CVSS 8.7
CVE-2026-83616 [HIGH] CVE-2026-83616 mathjax3: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [fedora-all]
CVE-2026-83616 mathjax3: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstruction(target, data) in lib/dom.js accepts an unvalidated target, while the requireWellFormed: true serializer checks only for a colon and the reserved case-insensitive xml name on 0.9.x and performs no target check on 0.8.x. Be
Bugzilla
CVE-2026-83616 jupyterlab: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [epel-all]
bugzilla·2026-09-03·CVSS 8.7
CVE-2026-83616 [HIGH] CVE-2026-83616 jupyterlab: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [epel-all]
CVE-2026-83616 jupyterlab: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstruction(target, data) in lib/dom.js accepts an unvalidated target, while the requireWellFormed: true serializer checks only for a colon and the reserved case-insensitive xml name on 0.9.x and performs no target check on 0.8.x. Be
Bugzilla
CVE-2026-83616 kf6-breeze-icons: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [epel-all]
bugzilla·2026-09-03·CVSS 8.7
CVE-2026-83616 [HIGH] CVE-2026-83616 kf6-breeze-icons: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [epel-all]
CVE-2026-83616 kf6-breeze-icons: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstruction(target, data) in lib/dom.js accepts an unvalidated target, while the requireWellFormed: true serializer checks only for a colon and the reserved case-insensitive xml name on 0.9.x and performs no target check on 0.8
Bugzilla
CVE-2026-83616 kf6-breeze-icons: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [fedora-all]
bugzilla·2026-09-03·CVSS 8.7
CVE-2026-83616 [HIGH] CVE-2026-83616 kf6-breeze-icons: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [fedora-all]
CVE-2026-83616 kf6-breeze-icons: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstruction(target, data) in lib/dom.js accepts an unvalidated target, while the requireWellFormed: true serializer checks only for a colon and the reserved case-insensitive xml name on 0.9.x and performs no target check on 0
Bugzilla
CVE-2026-83616 jupyterlab: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [fedora-all]
bugzilla·2026-09-03·CVSS 8.7
CVE-2026-83616 [HIGH] CVE-2026-83616 jupyterlab: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [fedora-all]
CVE-2026-83616 jupyterlab: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstruction(target, data) in lib/dom.js accepts an unvalidated target, while the requireWellFormed: true serializer checks only for a colon and the reserved case-insensitive xml name on 0.9.x and performs no target check on 0.8.x.
Bugzilla
CVE-2026-83616 mathjax3: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [epel-all]
bugzilla·2026-09-03·CVSS 8.7
CVE-2026-83616 [HIGH] CVE-2026-83616 mathjax3: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [epel-all]
CVE-2026-83616 mathjax3: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstruction(target, data) in lib/dom.js accepts an unvalidated target, while the requireWellFormed: true serializer checks only for a colon and the reserved case-insensitive xml name on 0.9.x and performs no target check on 0.8.x. Beca
Bugzilla
CVE-2026-83616 onnxruntime: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [fedora-all]
bugzilla·2026-09-03·CVSS 8.7
CVE-2026-83616 [HIGH] CVE-2026-83616 onnxruntime: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [fedora-all]
CVE-2026-83616 onnxruntime: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstruction(target, data) in lib/dom.js accepts an unvalidated target, while the requireWellFormed: true serializer checks only for a colon and the reserved case-insensitive xml name on 0.9.x and performs no target check on 0.8.x.
Bugzilla
CVE-2026-83616 crow-translate: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [fedora-all]
bugzilla·2026-09-03·CVSS 8.7
CVE-2026-83616 [HIGH] CVE-2026-83616 crow-translate: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [fedora-all]
CVE-2026-83616 crow-translate: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstruction(target, data) in lib/dom.js accepts an unvalidated target, while the requireWellFormed: true serializer checks only for a colon and the reserved case-insensitive xml name on 0.9.x and performs no target check on 0.8
Bugzilla
CVE-2026-83616 xmldom: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets
bugzilla·2026-09-01·CVSS 8.7
CVE-2026-83616 [HIGH] CVE-2026-83616 xmldom: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets
CVE-2026-83616 xmldom: xmldom: XML Structure Injection via Unvalidated Processing Instruction Targets
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstruction(target, data) in lib/dom.js accepts an unvalidated target, while the requireWellFormed: true serializer checks only for a colon and the reserved case-insensitive xml name on 0.9.x and performs no target check on 0.8.x. Because serialization emits , a target containing >, ?, whitespace, or another invalid XML-name character can break the processing-instruction boundary and inject XML structure. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12
https://github.com/xmldom/xmldom/commit/1cde3e31a07c41c87cfd368d6946aa477f16b4f9https://github.com/xmldom/xmldom/commit/3b694872bcb5c7e3cbadba961a4be2488750ce5bhttps://github.com/xmldom/xmldom/pull/1071https://github.com/xmldom/xmldom/pull/1072https://github.com/xmldom/xmldom/releases/tag/0.8.15https://github.com/xmldom/xmldom/releases/tag/0.9.12https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpvhttps://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv
2026-09-01
Published