CVE-2026-83607
Received Received - Intake

XML Injection in xmldom JavaScript Library

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-controlled tag names could inject attributes, elements, or processing instructions into serialized XML or HTML and could cause cross-site scripting when browser-consumed. The unchecked values violate the XML QName constraint, and default serialization and creation-time createElement() behavior remain permissive. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-83607
EUVD
EUVD-2026-69217

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
@xmldom xmldom From 0.7.0 (inc) to 0.9.0 (exc)
@xmldom xmldom From 0.8.0 (inc) to 0.8.13 (inc)
@xmldom xmldom 0.8.14
@xmldom xmldom From 0.9.0 (inc) to 0.9.11 (exc)
@xmldom xmldom 0.9.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-91 The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in xmldom allows attackers to inject malicious element names via the createElement() function. The serializer then outputs these names without validation, enabling XSS attacks when the XML/HTML is consumed by a browser. Existing security measures like requireWellFormed: true fail to prevent this issue.

Detection Guidance

Check installed versions of @xmldom/xmldom using npm list @xmldom/xmldom. If versions are between 0.7.0-0.8.13 or 0.9.0-0.9.10, the system is vulnerable. Review code for usage of createElement() and XMLSerializer.serializeToString() without requireWellFormed validation.

Impact Analysis

Attackers could inject malicious attributes like event handlers (e.g., onerror=alert(1)) into XML/HTML output. This could lead to XSS attacks when the content is rendered in a browser, potentially stealing data or executing arbitrary code in the user's context.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized code execution, violating GDPR's integrity and confidentiality requirements or HIPAA's security rules for protected health information. Organizations using vulnerable versions may face compliance violations.

Mitigation Strategies

Upgrade @xmldom/xmldom to versions 0.8.14 or 0.9.11 or later. If upgrading is not possible, add requireWellFormed: true to XMLSerializer.serializeToString() calls to enforce validation. Audit and sanitize tagName inputs to createElement() to prevent injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83607. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart