CVE-2026-83616
Summary
Document.createProcessingInstruction() in @xmldom/xmldom performs no validation on the target parameter. The requireWellFormed: true serializer option validates only for : in the target and a case-insensitive xml prefix, but does not check for > characters. A > in the target breaks the processing instruction boundary (<?...?>), allowing injection of arbitrary content into the serialized XML output.
Details
Document.createProcessingInstruction(target, data) at lib/dom.js around line 2413 accepts any string as the target parameter and stores it on the PI node without validation.
During serialization, the requireWellFormed code path (around line 3286) performs two checks on PI targets:
1. Rejects targets containing : (namespace prefix check)
2. Rejects targets matching xml case-insensitively (reserved prefix)
However, it does NOT validate that the target conforms to the XML Name production, and critically does NOT check for > characters. Since processing instructions are serialized as <?target data?>, a > in the target prematurely closes the PI, causing the remaining content to be interpreted as document content by any downstream XML parser.
Root Cause
1. createProcessingInstruction() performs no validation on target
2. The serializer's requireWellFormed check is incomplete -- it only checks for : and xml, missing characters that break PI syntax (>, ?, whitespace)
3. The serializer emits the target verbatim: <?${target} ${data}?>
Proof of Concept
const { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');
const impl = new DOMImplementation();
const serializer = new XMLSerializer();
const doc = impl.createDocument(null, 'root', null);
// PI target containing > breaks the PI boundary
const pi = doc.createProcessingInstruction('a>', 'data');
doc.documentElement.appendChild(pi);
const output = serializer.serializeToString(doc, { requireWellFormed: true });
console.log(output);
// Output: <root><?a> data?></root>
//
// The > in the target cl
⚡ Watch CVE-2026-83616
Get an email if CVE-2026-83616 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all EPSS-scored CVEs.
Advisory coverage (3)
- highGHSA-c7q8-3ch8-vqpv: xmldom: Processing Instruction Target Injection Bypasses requireWellFormedghsa · 2026-09-08
- unknownCVE-2026-83616: xmldom: Processing Instruction Target Injection Bypasses requireWellFormedmsrc · 2026-09-08
- unknownCVE-2026-83616: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSeriali…nvd · 2026-09-01
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-83616)