CVE-2026-83609
Received Received - Intake

Prototype Pollution in xmldom Library

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose later text injects markup when serialized through either the default path or requireWellFormed: true. The triggering ECMAScript line terminators are U+000A, U+000D, U+2028, and U+2029. This issue is fixed in @xmldom/xmldom version 0.9.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-83609
EUVD
EUVD-2026-69220

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
xmldom xmldom to 0.9.11 (inc)
xmldom xmldom 0.9.12
xmldom xmldom to 0.9.12 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-91 The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
CWE-625 The product uses a regular expression that does not sufficiently restrict the set of allowed values.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

xmldom versions 0.9.0 to 0.9.11 have a flaw in the shared reg() builder in lib/grammar.js. The multiline flag causes ^ and $ to validate only one line instead of the full name. This allows malformed XML names where the first line is valid but later text injects markup during serialization. The issue is fixed in version 0.9.12.

Detection Guidance

Check if your system uses xmldom versions 0.9.0 to 0.9.11. Run npm list xmldom or check package.json to verify the installed version.

Impact Analysis

Attackers could craft XML input with malicious markup injection, potentially leading to unauthorized data access, server-side request forgery, or other security breaches depending on how the library is used in applications.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Compliance may be compromised if exploited.

Mitigation Strategies

Upgrade xmldom to version 0.9.12 or later. Use npm update xmldom or modify package.json to specify the fixed version.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83609. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart