CVE-2026-83610

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-83610", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-31T20:36:25.743Z", "datePublished": "2026-09-01T14:31:49.409Z", "dateUpdated": "2026-09-03T16:00:03.283Z"}, "containers": {"cna": {"title": "xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization", "problemTypes": [{"descriptions": [{"cweId": "CWE-116", "lang": "en", "description": "CWE-116: Improper Encoding or Escaping of Output", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6"}, {"name": "https://github.com/xmldom/xmldom/pull/1071", "tags": ["x_refsource_MISC"], "url": "https://github.com/xmldom/xmldom/pull/1071"}, {"name": "https://github.com/xmldom/xmldom/pull/1072", "tags": ["x_refsource_MISC"], "url": "https://github.com/xmldom/xmldom/pull/1072"}, {"name": "https://github.com/xmldom/xmldom/commit/4664386e4f4d99d17b416a151dbe8323e245284b", "tags": ["x_refsource_MISC"], "url": "https://github.com/xmldom/xmldom/commit/4664386e4f4d99d17b416a151dbe8323e245284b"}, {"name": "https://github.com/xmldom/xmldom/commit/6c3fb5ffeafe7901ec928ce9010988dd716c94a0", "tags": ["x_refsource_MISC"], "url": "https://github.com/xmldom/xmldom/commit/6c3fb5ffeafe7901ec928ce9010988dd716c94a0"}, {"name": "https://github.com/xmldom/xmldom/releases/tag/0.8.15", "tags": ["x_refsource_MISC"], "url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15"}, {"name": "https://github.com/xmldom/xmldom/releases/tag/0.9.12", "tags": ["x_refsource_MISC"], "url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12"}], "affected": [{"vendor": "xmldom", "product": "xmldom", "versions": [{"version": "<= 0.6.0", "status": "affected"}]}, {"vendor": "@xmldom", "product": "xmldom", "versions": [{"version": ">= 0.7.0, < 0.8.15", "status": "affected"}, {"version": ">= 0.9.0, < 0.9.12", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-01T14:31:49.409Z"}, "descriptions": [{"lang": "en", "value": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReference(name) accepts an invalid name and the ENTITY_REFERENCE_NODE serializer emits the resulting nodeName directly in &name; form. Directly serializing the node or fragment with XMLSerializer.serializeToString() and requireWellFormed: true can therefore break the entity-reference boundary and produce attacker-controlled XML markup when reparsed. The parser does not ordinarily create these nodes, and element-child insertion is rejected, so exploitation requires an application to create and directly serialize an EntityReference. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom."}], "source": {"advisory": "GHSA-6gmq-8vp8-gcm6", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-03T15:59:56.681108Z", "id": "CVE-2026-83610", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-03T16:00:03.283Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-83610", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-03T15:59:56.681108Z"}}}], "references": [{"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-03T15:59:32.646Z"}}], "cna": {"title": "xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization", "source": {"advisory": "GHSA-6gmq-8vp8-gcm6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "xmldom", "product": "xmldom", "versions": [{"status": "affected", "version": "<= 0.6.0"}]}, {"vendor": "@xmldom", "product": "xmldom", "versions": [{"status": "affected", "version": ">= 0.7.0, < 0.8.15"}, {"status": "affected", "version": ">= 0.9.0, < 0.9.12"}]}], "references": [{"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6", "name": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/xmldom/xmldom/pull/1071", "name": "https://github.com/xmldom/xmldom/pull/1071", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/xmldom/xmldom/pull/1072", "name": "https://github.com/xmldom/xmldom/pull/1072", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/xmldom/xmldom/commit/4664386e4f4d99d17b416a151dbe8323e245284b", "name": "https://github.com/xmldom/xmldom/commit/4664386e4f4d99d17b416a151dbe8323e245284b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/xmldom/xmldom/commit/6c3fb5ffeafe7901ec928ce9010988dd716c94a0", "name": "https://github.com/xmldom/xmldom/commit/6c3fb5ffeafe7901ec928ce9010988dd716c94a0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15", "name": "https://github.com/xmldom/xmldom/releases/tag/0.8.15", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12", "name": "https://github.com/xmldom/xmldom/releases/tag/0.9.12", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReference(name) accepts an invalid name and the ENTITY_REFERENCE_NODE serializer emits the resulting nodeName directly in &name; form. Directly serializing the node or fragment with XMLSerializer.serializeToString() and requireWellFormed: true can therefore break the entity-reference boundary and produce attacker-controlled XML markup when reparsed. The parser does not ordinarily create these nodes, and element-child insertion is rejected, so exploitation requires an application to create and directly serialize an EntityReference. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116: Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-01T14:31:49.409Z"}}}, "cveMetadata": {"cveId": "CVE-2026-83610", "state": "PUBLISHED", "dateUpdated": "2026-09-03T16:00:03.283Z", "dateReserved": "2026-08-31T20:36:25.743Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-01T14:31:49.409Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "xmldom", "vendor": "xmldom", "versions": [{"status": "affected", "version": "<= 0.6.0"}]}, {"product": "xmldom", "vendor": "@xmldom", "versions": [{"status": "affected", "version": ">= 0.7.0, < 0.8.15"}, {"status": "affected", "version": ">= 0.9.0, < 0.9.12"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReference(name) accepts an invalid name and the ENTITY_REFERENCE_NODE serializer emits the resulting nodeName directly in &name; form. Directly serializing the node or fragment with XMLSerializer.serializeToString() and requireWellFormed: true can therefore break the entity-reference boundary and produce attacker-controlled XML markup when reparsed. The parser does not ordinarily create these nodes, and element-child insertion is rejected, so exploitation requires an application to create and directly serialize an EntityReference. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom."}], "id": "CVE-2026-83610", "lastModified": "2026-09-08T21:11:31.703", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-83610", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-03T15:59:56.681108Z", "version": "2.0.3"}}]}, "published": "2026-09-01T15:17:39.107", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/xmldom/xmldom/commit/4664386e4f4d99d17b416a151dbe8323e245284b"}, {"source": "security-advisories@github.com", "url": "https://github.com/xmldom/xmldom/commit/6c3fb5ffeafe7901ec928ce9010988dd716c94a0"}, {"source": "security-advisories@github.com", "url": "https://github.com/xmldom/xmldom/pull/1071"}, {"source": "security-advisories@github.com", "url": "https://github.com/xmldom/xmldom/pull/1072"}, {"source": "security-advisories@github.com", "url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15"}, {"source": "security-advisories@github.com", "url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12"}, {"source": "security-advisories@github.com", "url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "xmldom: @xmldom/xmldom: xmldom: XML fragment injection via invalid EntityReference serialization", "id": "2526820", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526820"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-91", "details": ["A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. The Document.createEntityReference function incorrectly accepts invalid names, which are then directly emitted during serialization. This vulnerability allows an attacker to inject arbitrary XML fragments when an application creates and directly serializes an EntityReference with specific settings. This can lead to the manipulation of XML data when the output is subsequently re-parsed."], "name": "CVE-2026-83610", "package_state": [{"cpe": "cpe:/a:redhat:podman_desktop:1", "fix_state": "Fix deferred", "package_name": "rh-podman-desktop.git", "product_name": "Red Hat Build of Podman Desktop"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "xmldom", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-mlflow-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift4/ose-console", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-01T14:31:49Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-83610\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-83610\nhttps://github.com/xmldom/xmldom/commit/4664386e4f4d99d17b416a151dbe8323e245284b\nhttps://github.com/xmldom/xmldom/commit/6c3fb5ffeafe7901ec928ce9010988dd716c94a0\nhttps://github.com/xmldom/xmldom/pull/1071\nhttps://github.com/xmldom/xmldom/pull/1072\nhttps://github.com/xmldom/xmldom/releases/tag/0.8.15\nhttps://github.com/xmldom/xmldom/releases/tag/0.9.12\nhttps://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.6.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "xmldom", "source": "cna", "vendor": "xmldom"}, "product": "xmldom", "vendor": "xmldom"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.7.0,0.8.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.9.0,0.9.12)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "xmldom", "source": "cna", "vendor": "@xmldom"}, "product": "xmldom", "vendor": "xmldom"}], "created": "2026-09-01T15:45:04.993388+00:00", "updated": "2026-09-02T04:45:17.732586+00:00", "vendors": ["xmldom", "xmldom$PRODUCT$xmldom"], "weaknesses": ["CWE-116", "CWE-91"]}