xmldom up to 0.9.11 Serializer lib/grammar.js reg injection

Summaryinfo

A vulnerability was found in xmldom up to 0.9.11. It has been rated as critical. Affected by this vulnerability is the function reg of the file lib/grammar.js of the component Serializer. This manipulation causes injection. This vulnerability is registered as CVE-2026-83618. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in xmldom up to 0.9.11 and classified as critical. Affected by this vulnerability is the function reg of the file lib/grammar.js of the component Serializer. The manipulation with an unknown input leads to a injection vulnerability. The CWE definition for the vulnerability is CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with PubidLiteral_match and SystemLiteral_match expressions produced by reg() in lib/grammar.js, which inherit the multiline flag. A complete valid literal on the first line can therefore satisfy the matcher while U+000A, U+000D, U+2028, or U+2029 and breakout markup remain in the emitted <!DOCTYPE ...> declaration. This bypasses the strict-serialization mitigation for the earlier DocumentType injection advisory; creation and direct property assignment remain unvalidated by design. This issue is fixed in @xmldom/xmldom version 0.9.12.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-83618 since 08/31/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1055 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 342300 (Linux Distros Unpatched Vulnerability : CVE-2026-83618), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.9.12 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (342300) and EUVD (EUVD-2026-69244). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• xmldom

Version

• 0.9.0
• 0.9.1
• 0.9.2
• 0.9.3
• 0.9.4
• 0.9.5
• 0.9.6
• 0.9.7
• 0.9.8
• 0.9.9
• 0.9.10
• 0.9.11

Website

• Product: https://github.com/xmldom/xmldom/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion