CVE-2026-83608
Summary
The @xmldom/xmldom serializer emits DocumentType.name verbatim into the
<!DOCTYPE …> declaration with no well-formedness guard. GHSA-f6ww-3ggp-fr8h
(CVE-2026-41674) hardened the serializer's requireWellFormed path for a
DocumentType's sibling fields — publicId, systemId, and internalSubset —
but it did not add any check for name. A > (or whitespace) in the name
terminates the doctype declaration early, letting the remaining characters
become sibling markup in the serialized output.
Because requireWellFormed: true — the recommended mitigation for the prior
xmldom injection CVEs — performs no validation on the DocType name, this is a
bypass of that control, in the same family as the open element-name
(GHSA-w2rr-34g9-rvrj) and attribute-name (GHSA-4w3w-2rp5-g8jm) name-injection advisories.
Details
The serializer's DOCUMENT_TYPE_NODE case runs the requireWellFormed block
only against publicId, systemId, and internalSubset, then pushes
n.name directly into the buffer between the <!DOCTYPE prefix and the
closing >:
- 0.9.x (v0.9.10, bb7a085):
serializer DocType case, lib/dom.js#L3256-L3283
— the requireWellFormed block (#L3259-L3269)
validates publicId/systemId/internalSubset but not name, which is
emitted verbatim at #L3270.
- 0.8.x (v0.8.13, e5c1480):
serializer DocType case, lib/dom.js#L1914-L1946
— same structure; name is emitted verbatim at #L1928.
- unscoped xmldom (v0.6.0, c80a161):
lib/dom.js#L1105
emits node.name verbatim; this line predates requireWellFormed, so there
is no well-formedness path at all.
Enabling write paths
DocumentType.name is a plain, writable own-property, so the enabling vector
differs by line:
- 0.9.x — createDocumentType() validates the name via
validateQualifiedName (lib/dom.js#L925-L936,
validation at #L926),
so the deliverable vector is a direct property write
(dt.name = 'html><script>…') to the unguarded own-property.
- 0.8.x — createDocumentType() does not validate the name
(lib/dom.js#L456-L464),
so the malicious name
⚡ Watch CVE-2026-83608
Get an email if CVE-2026-83608 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all EPSS-scored CVEs.
Advisory coverage (3)
- highGHSA-27p8-2357-5qqv: xmldom: DocType `name` Injection Bypasses requireWellFormedghsa · 2026-09-08
- unknownCVE-2026-83608: xmldom: DocType `name` Injection Bypasses requireWellFormedmsrc · 2026-09-08
- unknownCVE-2026-83608: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSeriali…nvd · 2026-09-01
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-83608)