chore(deps): update dependency @xmldom/xmldom to v0.8.15 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@xmldom/xmldom	0.8.13 → 0.8.15

---

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

CVE-2026-83610 / GHSA-6gmq-8vp8-gcm6

More information

Details

Summary

An EntityReference node can be created with an invalid, attacker-controlled name through Document.createEntityReference(name). When this node is serialized directly with:

serializer.serializeToString(ref, { requireWellFormed: true })

the invalid nodeName is emitted into the serialized XML fragment without validation or escaping.

This can produce real XML markup in the serialized output. In the proof of concept below, the serialized fragment contains <injected/>, and reparsing the fragment creates a real injected element.

---

Details

The issue appears to be in the serialization path for ENTITY_REFERENCE_NODE.

For several other node types, requireWellFormed: true performs specific validation checks before serialization. For example, comments, processing instructions, document types, and some character data cases are checked before being emitted.

However, for ENTITY_REFERENCE_NODE, the serializer appears to emit the node name directly in entity reference form:

case ENTITY_REFERENCE_NODE:
  buf.push('&', n.nodeName, ';');
  return null;

As a result, if nodeName contains characters that break out of the intended &name; structure, the serializer can emit additional XML markup.

For example, an entity reference created with the name:

safe; <injected/> &x

is serialized as:

&safe; <injected/> &x;

When this fragment is later parsed in an XML context, <injected/> becomes a real element.

This is especially surprising when { requireWellFormed: true } is used, because applications may reasonably treat this mode as the stricter or safer XML serialization mode.

---

Proof of Concept

Tested with:

@xmldom/xmldom@0.9.10
Node.js v24.18.0
Windows 10 / PowerShell

'use strict';

const { DOMImplementation, XMLSerializer, DOMParser } = require('@xmldom/xmldom');

const impl = new DOMImplementation();
const doc = impl.createDocument(null, 'root', null);
const serializer = new XMLSerializer();

function countInjected(fragment) {
  try {
    const parsed = new DOMParser().parseFromString(`<root>${fragment}</root>`, 'application/xml');
    return parsed.getElementsByTagName('injected').length;
  } catch (e) {
    return `PARSE_THROW ${e.name}: ${e.message}`;
  }
}

for (const name of [
  'safe',
  'safe; <injected/> &x',
  'x<injected',
  'x y'
]) {
  try {
    const ref = doc.createEntityReference(name);
    const xml = serializer.serializeToString(ref, { requireWellFormed: true });

    console.log(`[SERIALIZED] ${JSON.stringify(name)}: ${xml}`);
    console.log(`[INJECTED_COUNT] ${JSON.stringify(name)}: ${countInjected(xml)}`);
  } catch (e) {
    console.log(`[THROW] ${JSON.stringify(name)}: ${e.name}: ${e.message}`);
  }
}

Observed output:

[SERIALIZED] "safe": &safe;
[INJECTED_COUNT] "safe": 0

[SERIALIZED] "safe; <injected/> &x": &safe; <injected/> &x;
[INJECTED_COUNT] "safe; <injected/> &x": 1

[SERIALIZED] "x<injected": &x<injected;
[INJECTED_COUNT] "x<injected": 0

[SERIALIZED] "x y": &x y;
[INJECTED_COUNT] "x y": 0

---

Impact

An application that creates an EntityReference from attacker-controlled input and then serializes that node or XML fragment with requireWellFormed: true may produce XML containing attacker-controlled markup.

The impact is limited by two observations:

1. The parser does not create EntityReference nodes from ordinary XML entity references.
2. Appending an EntityReference node as an element child is rejected with a HierarchyRequestError.

The main affected scenario is applications that directly use createEntityReference(name) and then serialize the resulting node or fragment.

Fix Applied

Two complementary, non-breaking fixes.
(1) document.createEntityReference(name) rejects an invalid Name at creation, closing the reachable creation vector by default — the opt-in serializer check alone cannot, since a later nodeName mutation would bypass a creation-only guard.
(2) Under requireWellFormed, the serializer validates the EntityReference nodeName as a well-formed XML Name and throws InvalidStateError when it is not; a valid reference still serializes as &name;. Both ship on both maintained versions. The EntityReference / createEntityReference docs note that under requireWellFormed the nodeName is validated as an XML Name, and that xmldom does not expand entities. See the XML Name production.

⚠ Opt-in required. Protection is not automatic. Existing serialization calls remain
vulnerable unless { requireWellFormed: true } is explicitly passed. Applications that
serialize untrusted DOM content should audit all serializeToString() call sites and add it.

Proof of Concept - fixed path

'use strict';

const { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');

const impl = new DOMImplementation();
const doc = impl.createDocument(null, 'root', null);
const serializer = new XMLSerializer();

// Creation-time anchor (applied by default): an invalid XML Name is rejected at creation.
try {
  doc.createEntityReference('safe; <injected/> &x');
} catch (e) {
  console.log(`${e.name}`); // rejected at creation
}

// Default path (requireWellFormed omitted): because creation now rejects an ill-formed name,
// an ill-formed nodeName is only reachable via a post-creation mutation — and is emitted verbatim.
const ref = doc.createEntityReference('safe');
ref.nodeName = 'safe; <injected/> &x';
console.log(serializer.serializeToString(ref));
// -> &safe; <injected/> &x;   (injection present on the default path)

// Opt-in path: throws on the invalid nodeName.
try {
  serializer.serializeToString(ref, { requireWellFormed: true });
} catch (e) {
  console.log(`${e.name}`); // InvalidStateError
}

// A valid name still serializes as &name; under requireWellFormed.
const ok = doc.createEntityReference('valid');
console.log(serializer.serializeToString(ok, { requireWellFormed: true }));
// -> &valid;

Why the default stays verbatim

The creation-time anchor is applied by default, because it is classified non-breaking. The serializer check, by contrast, stays gated behind { requireWellFormed: true }: W3C DOM Parsing's require-well-formed flag defaults to false, and the browser XMLSerializer emits the nodeName verbatim in that default mode, so unconditionally throwing for an ill-formed EntityReference.nodeName would be an unjustified breaking change — which is why the default serialization path stays verbatim.

Residual limitation

The creation vector is closed by default — the non-breaking creation-time anchor — with no further deferred work. The residual is at serialization: the default path still emits an ill-formed nodeName verbatim, because the serializer check is opt-in via { requireWellFormed: true }.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6
• https://nvd.nist.gov/vuln/detail/CVE-2026-83610
• https://github.com/xmldom/xmldom/pull/1071
• https://github.com/xmldom/xmldom/pull/1072
• https://github.com/xmldom/xmldom/commit/4664386e4f4d99d17b416a151dbe8323e245284b
• https://github.com/xmldom/xmldom/commit/6c3fb5ffeafe7901ec928ce9010988dd716c94a0
• https://github.com/xmldom/xmldom
• https://github.com/xmldom/xmldom/releases/tag/0.8.15
• https://github.com/xmldom/xmldom/releases/tag/0.9.12

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

xmldom/xmldom (@​xmldom/xmldom)

v0.8.15

Compare Source

Fixed

• Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from DOMParser.parseFromString with default options. Serialized output is byte-identical. GHSA-965w-775f-mr7g
• Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the NamedNodeMap parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML no-duplicate-attributes well-formedness constraint. GHSA-8344-3jmq-59r6
• Security: trimming trailing whitespace from an XML end tag (ETag) is now anchored so it runs in linear time instead of backtracking quadratically on a long whitespace run, preventing a ReDoS reachable from DOMParser.parseFromString. Trimmed output is byte-identical. GHSA-x4fp-j954-r2f4
• Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded <, and Node.prototype.normalize() merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per normalize() in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. GHSA-93r5-fhx6-vmg9
• Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now rejects a DocType name that is not a valid XML Name, throwing InvalidStateError — matching the sibling publicId/systemId/internalSubset checks and preventing XML injection via DocumentType.name. GHSA-27p8-2357-5qqv
• Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now validates a processing-instruction target as an XML NCName and rejects a case-insensitive xml, throwing InvalidStateError — a check 0.8.x did not previously perform, preventing PI-target injection via >, ?, or whitespace. GHSA-c7q8-3ch8-vqpv
• Security: Document.createEntityReference() now rejects an invalid XML Name at creation, and XMLSerializer.serializeToString() under { requireWellFormed: true } validates an EntityReference nodeName as an XML Name, throwing InvalidStateError — preventing XML injection via an entity-reference name. GHSA-6gmq-8vp8-gcm6
• Security: the parser now reports a not-well-formed end tag whose valid name is followed by trailing content as a recoverable error instead of accepting it silently, per the XML ETag production; parsing recovers to the byte-identical DOM. Consumers that want strict rejection can escalate the reported error to fatal via the parser's errorHandler. GHSA-6h8r-xr42-gp59

Thank you,
@​ericchiang,
@​bhaswanthc,
@​arpitjain099,
@​Paranoidgrinch,
for your contributions

v0.8.14

Compare Source

Fixed

• Security: XMLSerializer.serializeToString() now also rejects invalid element and attribute names when { requireWellFormed: true } is passed, throwing InvalidStateError for a name that is not a valid XML QName (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized xmlns: declaration). This prevents XML injection via createElement() / setAttribute(), extending the existing requireWellFormed checks to the serialized name set. GHSA-w2rr-34g9-rvrj GHSA-4w3w-2rp5-g8jm

Thank you,
@​bhaswanthc,
@​jmestwa-coder,
for your contributions

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.