CVE-2026-83616

A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. An attacker can exploit a vulnerability in how processing instructions are handled to inject arbitrary XML structures. This occurs because the software fails to properly validate input, allowing special characters to bypass security checks. Successful exploitation could lead to data manipulation or other integrity impacts within applications processing the affected XML.

A flaw was found in the xmldom JavaScript package. The Document.createProcessingInstruction() function in lib/dom.js fails to validate target strings, and XMLSerializer.serializeToString() with requireWellFormed: true performs insufficient target validation. An attacker supplying crafted processing instruction targets containing special characters (such as >, ?, or whitespace) can break processing instruction boundaries (<?target data?>) during serialization. This enables arbitrary XML markup injection, compromising document integrity in applications processing serialized XML output.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Sanitize or validate all target strings passed to Document.createProcessingInstruction() to ensure compliance with XML Name production rules prior to serialization.