CVE-2026-83608: xmldom: DocType `name` Injection Bypasses requireWellFormed
The @xmldom/xmldom serializer emits DocumentType.name verbatim into the
<!DOCTYPE …> declaration with no well-formedness guard. GHSA-f6ww-3ggp-fr8h
(CVE-2026-41674) hardened the serializer’s requireWellFormed path for a
DocumentType’s sibling fields — publicId, systemId, and internalSubset —
but it did not add any check for name. A > (or whitespace) in the name
terminates the doctype declaration early, letting the remaining characters
become sibling markup in the serialized output.
Because requireWellFormed: true — the recommended mitigation for the prior
xmldom injection CVEs — performs no validation on the DocType name, this is a
bypass of that control, in the same family as the open element-name
(GHSA-w2rr-34g9-rvrj) and attribute-name (GHSA-4w3w-2rp5-g8jm) name-injection advisories.
References
- github.com/advisories/GHSA-27p8-2357-5qqv
- github.com/xmldom/xmldom/commit/57aec90ac57b4408ae7c5d1746bf2a693b5ed90e
- github.com/xmldom/xmldom/commit/85f12eb4d14b44de33216cfb72b50af4d24e9fdd
- github.com/xmldom/xmldom/pull/1071
- github.com/xmldom/xmldom/pull/1072
- github.com/xmldom/xmldom/releases/tag/0.8.15
- github.com/xmldom/xmldom/releases/tag/0.9.12
- github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv
- nvd.nist.gov/vuln/detail/CVE-2026-83608
Code Behaviors & Features
Detect and mitigate CVE-2026-83608 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →