CVE-2026-83618

In @xmldom/xmldom versions 0.9.10 through 0.9.11, the strict XMLSerializer (requireWellFormed: true) validates DocumentType.publicId and DocumentType.systemId using regular expressions that inherit the multiline flag, so a literal can pass validation based on its first line while line-break characters (U+000A, U+000D, U+2028, U+2029) or breakout markup remain embedded in the emitted <!DOCTYPE ...> declaration. An attacker triggers this by getting untrusted input into a DocumentType node's publicId or systemId — properties that are deliberately unvalidated at creation and direct assignment — and then having the application serialize the document in strict mode. The result is markup injection into the serialized XML output (CWE-91), defeating the strict-serialization mitigation intended to prevent DocumentType injection; per the CVSS 4.0 score the impact is confined to data integrity (VI:H), with no confidentiality or availability impact. Anyone on npm using @xmldom/xmldom 0.9.10 or 0.9.11 and serializing documents whose DOCTYPE identifiers can be influenced by untrusted input is affected; the flaw is fixed in 0.9.12. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade @xmldom/xmldom to 0.9.12 or later. As an interim mitigation, strip line-break characters (U+000A, U+000D, U+2028, U+2029) and markup from DocumentType publicId/systemId values before serialization, or avoid enabling requireWellFormed: true for untrusted documents. Audit your dependency tree for pinned or locked 0.9.10/0.9.11 versions and confirm whether your code serializes attacker-influenced DOCTYPE identifiers.