CVE-2026-83605
Received Received - Intake

XSS via Unvalidated Attribute Names in xmldom

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private _createAttribute(name) path without validating the attribute name, while Document.createAttribute(name) validates against QName. XMLSerializer.serializeToString() emits attribute names verbatim, and requireWellFormed: true did not validate them, so a crafted name can terminate the intended attribute and inject additional attributes, including event handlers, into browser-consumed output; synthesized xmlns:PREFIX declarations expose the same unchecked-name boundary. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-83605
EUVD
EUVD-2026-69215

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-91 The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

xmldom is a JavaScript module for parsing and serializing XML. A vulnerability exists where Element.setAttribute() does not validate attribute names, allowing crafted names to inject additional attributes or event handlers into output. This bypasses intended security checks in Document.createAttribute() and XMLSerializer.serializeToString().

Detection Guidance

To detect this vulnerability, check if your system uses vulnerable versions of xmldom (0.7.0-0.8.13, 0.9.0-0.9.10). Run: npm list xmldom or npm audit. Inspect code for setAttribute() or createElement() calls without requireWellFormed validation.

Impact Analysis

An attacker could exploit this to inject malicious attributes or event handlers into XML output, potentially leading to cross-site scripting (XSS) attacks or unauthorized actions in applications using affected xmldom versions.

Compliance Impact

This vulnerability could lead to XML injection attacks, potentially exposing sensitive data processed by applications using xmldom. Such attacks may violate data protection requirements under GDPR (e.g., unauthorized data access) and HIPAA (e.g., breaches of protected health information). Non-compliance risks include legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade to patched versions: @xmldom/xmldom 0.8.14 or 0.9.11. Enable requireWellFormed: true in XMLSerializer.serializeToString() calls. Review and sanitize inputs to setAttribute() and createElement().

If upgrading is not possible, disable dynamic attribute/element creation or implement strict input validation for XML names.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83605. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart