THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-6gmq-8vp8-gcm6 (medium) — xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

[GHSA] GHSA-6gmq-8vp8-gcm6 (medium) — xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

medgithub_advisoriesPublished 2026-09-02

GHSA-6gmq-8vp8-gcm6 Severity: medium CVE: CVE-2026-83610

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

## Summary

An `EntityReference` node can be created with an invalid, attacker-controlled name through `Document.createEntityReference(name)`. When this node is serialized directly with:

```js serializer.serializeToString(ref, { requ

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://github.com/advisories/GHSA-6gmq-8vp8-gcm6