CVE-2026-83610

A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. The Document.createEntityReference function incorrectly accepts invalid names, which are then directly emitted during serialization. This vulnerability allows an attacker to inject arbitrary XML fragments when an application creates and directly serializes an EntityReference with specific settings. This can lead to the manipulation of XML data when the output is subsequently re-parsed.

This Moderate flaw in xmldom allows for XML fragment injection. Exploitation requires an application to explicitly create and serialize an EntityReference with an invalid name, which is not a default or common operation in Red Hat products, thus limiting the attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.