CVE-2026-83616

Name of the Vulnerable Software and Affected Versions @xmldom/xmldom versions prior to 0.8.15 @xmldom/xmldom versions prior to 0.9.12 xmldom versions 0.6.0 and earlier

Description The Document.createProcessingInstruction(target, data) function in lib/dom.js accepts an unvalidated target parameter. When the requireWellFormed: true serializer is used, it only checks for colons and the reserved case-insensitive xml name in the 0.9.x branch and performs no target check in the 0.8.x branch. Since serialization produces <?target data?>, a target containing characters such as >, ?, whitespace, or other invalid XML-name characters can break the processing-instruction boundary, allowing the injection of XML structure.

Recommendations Update @xmldom/xmldom to version 0.8.15 or later. Update @xmldom/xmldom to version 0.9.12 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability.