Node xmldom: Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReference(name) accepts an invalid… (CVE-2026-83610)

The node-xmldom library, a JavaScript XML DOM parser and serializer, has a vulnerability in versions prior to @xmldom/xmldom 0.8.15 and 0.9.12, and in xmldom 0.6.0 and earlier. The Document.createEntityReference(name) method accepts invalid entity names, and the ENTITY_REFERENCE_NODE serializer emits the nodeName directly in &name; form. When serialized with XMLSerializer.serializeToString() using requireWellFormed: true, this can break the entity-reference boundary and produce attacker-controlled XML markup upon reparsing. The parser normally does not create these nodes, and element-child insertion is rejected, so exploitation requires an application to explicitly create and serialize an EntityReference node. The issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version exists for xmldom.

An attacker can craft XML that, when serialized and reparsed, results in attacker-controlled XML markup due to improper handling of entity references. This could potentially lead to XML injection or manipulation in applications that create and serialize EntityReference nodes directly. However, exploitation requires specific application behavior, limiting the impact.

Upgrade to @xmldom/xmldom versions 0.8.15 or 0.9.12 where the vulnerability is fixed. For xmldom, no fixed version is currently available, so avoid using Document.createEntityReference with untrusted input or avoid serializing EntityReference nodes. Monitor vendor advisories for updates regarding xmldom.