THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-c7q8-3ch8-vqpv (high) — xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

[GHSA] GHSA-c7q8-3ch8-vqpv (high) — xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

medgithub_advisoriesPublished 2026-09-08

GHSA-c7q8-3ch8-vqpv Severity: high CVE: CVE-2026-83616

xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

## Summary

`Document.createProcessingInstruction()` in `@xmldom/xmldom` performs no validation on the `target` parameter. The `requireWellFormed: true` serializer option validates only for `:` in the target and a case-insensitive `xml` prefix, but does not check for

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://github.com/advisories/GHSA-c7q8-3ch8-vqpv