CVE-2026-83608

Name of the Vulnerable Software and Affected Versions @xmldom/xmldom versions prior to 0.8.15 @xmldom/xmldom versions prior to 0.9.12 xmldom versions 0.6.0 and earlier

Description The DOCUMENT TYPE NODE branch in lib/dom.js validates publicId, systemId, and internalSubset when requireWellFormed is set to true, but it emits DocumentType.name verbatim. If the name contains whitespace or a > character, it can prematurely terminate the <!DOCTYPE ...> declaration, allowing the injection of sibling markup. This value can be supplied via the createDocumentType() function in the 0.8.x and unscoped lines, or through a direct write to the DocumentType.name property across all affected versions. While the default path and legacy creation-time behavior are permissive, the strict path fails to enforce a valid XML Name.

Recommendations Update @xmldom/xmldom to version 0.8.15 or later. Update @xmldom/xmldom to version 0.9.12 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability.