CVE-2026-83616highCWE-91

CVE-2026-83616: falha de alta gravidade em @xmldom xmldom

xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

Publicada em

Seguir esta CVE+ Monitorar xmldom+ Monitorar node-xmldom

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.6%
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstruction(target, data) in lib/dom.js accepts an unvalidated target, while the requireWellFormed: true serializer checks only for a colon and the reserved case-insensitive xml name on 0.9.x and performs no target check on 0.8.x. Because serialization emits <?target data?>, a target containing >, ?, whitespace, or another invalid XML-name character can break the processing-instruction boundary and inject XML structure. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
@xmldom · xmldomxmldom · xmldom
CVEs relacionadas — @xmldom xmldom

No mesmo produto, das mais perigosas para as menos.

CVE-2022-39353CRITICALxmldom allows multiple root nodes in a DOMEPSS 1.6%CVE-2021-32796MEDIUMMisinterpretation of malicious XML input in xmldomEPSS 1.4%CVE-2021-21366MEDIUMMisinterpretation of malicious XML inputEPSS 1.3%CVE-2026-41673HIGHxmldom: Denial of service via uncontrolled recursion in XML serializationEPSS 0.6%CVE-2026-83611MEDIUMxmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing contentEPSS 0.6%CVE-2026-83608HIGHxmldom: DocType `name` Injection Bypasses requireWellFormedEPSS 0.6%