CVE-2026-83610

## Summary An `EntityReference` node can be created with an invalid, attacker-controlled name through `Document.createEntityReference(name)`. When this node is serialized directly with: ```js serializer.serializeToString(ref, { requireWellFormed: true }) ``` the invalid `nodeName` is emitted into the serialized XML fragment without validation or escaping. This can produce real XML markup in the serialized output. In the proof of concept below, the serialized fragment contains `<injected/>`, and reparsing the fragment creates a real `injected` element. --- ## Details The issue appears to be in the serialization path for `ENTITY_REFERENCE_NODE`. For several other node types, `requireWellFormed: true` performs specific validation checks before serialization. For example, comments, processing instructions, document types, and some character data cases are checked before being emitted. However, for `ENTITY_REFERENCE_NODE`, the serializer appears to emit the node name directly in entity reference form: ```js case ENTITY_REFERENCE_NODE: buf.push('&', n.nodeName, ';'); return null; ``` As a result, if `nodeName` contains characters that break out of the intended `&name;` structure, the serializer can emit additional XML markup. For example, an entity reference created with the name: ```text safe; <injected/> &x ``` is serialized as: ```xml &safe; <injected/> &x; ``` When this fragment is later parsed in an XML context, `<injected/>` becomes a real element. This is especially surprising when `{ requireWellFormed: true }` is used, because applications may reasonably treat this mode as the stricter or safer XML serialization mode. --- ## Proof of Concept Tested with: ```text @xmldom/[email protected] Node.js v24.18.0 Windows 10 / PowerShell ``` ```js 'use strict'; const { DOMImplementation, XMLSerializer, DOMParser } = require('@xmldom/xmldom'); const impl = new DOMImplementation(); const doc = impl.createDocument(null, 'root', null); const serializer =