CVE-2026-83610

Name of the Vulnerable Software and Affected Versions @xmldom/xmldom versions prior to 0.8.15 @xmldom/xmldom versions prior to 0.9.12 xmldom versions 0.6.0 and earlier

Description The Document.createEntityReference(name) function accepts invalid names, and the ENTITY REFERENCE NODE serializer emits the resulting nodeName directly in &name; format. When a node or fragment is serialized using XMLSerializer.serializeToString() with requireWellFormed set to true, it can break the entity-reference boundary. This allows the production of attacker-controlled XML markup upon reparsing. Exploitation occurs if an application creates and directly serializes an EntityReference.

Recommendations Update @xmldom/xmldom to version 0.8.15. Update @xmldom/xmldom to version 0.9.12. At the moment, there is no information about a newer version that contains a fix for this vulnerability.