CVE-2026-83616

xmldom, a pure-JavaScript W3C XML DOM parser and serializer distributed on npm, does not validate the target argument of Document.createProcessingInstruction(), and its serializer — which emits processing instructions as "<?target data?>" — only checks the target for a colon and the reserved "xml" name on 0.9.x and performs no target check at all on 0.8.x. A target containing ">", "?", whitespace, or other invalid XML-name characters therefore breaks the processing-instruction boundary and injects attacker-controlled XML structure into the serialized output, yielding high integrity impact (CVSS 4.0: 8.7) with no direct confidentiality or availability impact. Applications that pass attacker-controlled data as the target of createProcessingInstruction and then serialize the document are exposed to malformed or re-forged XML consumed by downstream processors. All npm consumers of @xmldom/xmldom prior to 0.8.15 (0.8.x line) or prior to 0.9.12 (0.9.x line), and users of the legacy unscoped xmldom package version 0.6.0 and earlier, are affected. There is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns a 0.3% probability of exploitation within 30 days (28th percentile).

What to do: Upgrade @xmldom/xmldom to 0.8.15 if you are on the 0.8.x line or 0.9.12 if you are on the 0.9.x line; the legacy unscoped xmldom package has no fixed release, so migrate to the maintained @xmldom/xmldom package. Scan lockfiles and transitive dependencies (e.g., via npm audit) and review code paths where createProcessingInstruction receives attacker-controlled target values, validating the target against XML Name rules before serialization.