CVE-2026-83610
Summary
An EntityReference node can be created with an invalid, attacker-controlled name through Document.createEntityReference(name). When this node is serialized directly with:
serializer.serializeToString(ref, { requireWellFormed: true })
the invalid nodeName is emitted into the serialized XML fragment without validation or escaping.
This can produce real XML markup in the serialized output. In the proof of concept below, the serialized fragment contains <injected/>, and reparsing the fragment creates a real injected element.
Details
The issue appears to be in the serialization path for ENTITY_REFERENCE_NODE.
For several other node types, requireWellFormed: true performs specific validation checks before serialization. For example, comments, processing instructions, document types, and some character data cases are checked before being emitted.
However, for ENTITY_REFERENCE_NODE, the serializer appears to emit the node name directly in entity reference form:
case ENTITY_REFERENCE_NODE:
buf.push('&', n.nodeName, ';');
return null;
As a result, if nodeName contains characters that break out of the intended &name; structure, the serializer can emit additional XML markup.
For example, an entity reference created with the name:
safe; <injected/> &x
is serialized as:
&safe; <injected/> &x;
When this fragment is later parsed in an XML context, <injected/> becomes a real element.
This is especially surprising when { requireWellFormed: true } is used, because applications may reasonably treat this mode as the stricter or safer XML serialization mode.
Proof of Concept
Tested with:
@xmldom/[email protected]
Node.js v24.18.0
Windows 10 / PowerShell
'use strict';
const { DOMImplementation, XMLSerializer, DOMParser } = require('@xmldom/xmldom');
const impl = new DOMImplementation();
const doc = impl.createDocument(null, 'root', null);
const serializer = new XMLSerializer();
function countInjected(fragment) {
try {
const parsed = new DOMParser().parseFromStri
⚡ Watch CVE-2026-83610
Get an email if CVE-2026-83610 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all EPSS-scored CVEs.
Advisory coverage (3)
- unknownCVE-2026-83610: xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed s…msrc · 2026-09-08
- mediumGHSA-6gmq-8vp8-gcm6: xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFor…ghsa · 2026-09-02
- unknownCVE-2026-83610: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSeriali…nvd · 2026-09-01
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-83610)