CVE-2026-83617
Received Received - Intake

XML External Entity Injection in xmldom

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QName_exact expression produced by reg() in lib/grammar.js, which inherits the multiline flag. A name with a valid first line followed by U+000A, U+000D, U+2028, or U+2029 and breakout markup therefore passes validation and is emitted verbatim in element start and end tags or attribute names. This bypasses the strict-serialization checks introduced for the earlier element-name and attribute-name injection advisories, while the default serialization path remains outside the strict guarantee. This issue is fixed in @xmldom/xmldom version 0.9.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-83617
EUVD
EUVD-2026-69241

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
xmldom xmldom to 0.9.12 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-91 The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
CWE-625 The product uses a regular expression that does not sufficiently restrict the set of allowed values.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in xmldom versions 0.9.11 to 0.9.12 allows element and attribute names containing a valid first line followed by a line break character and malicious markup to bypass strict validation. The issue stems from improper handling of multiline flags in name checks, enabling injection attacks despite prior fixes for similar issues.

Detection Guidance

This vulnerability affects xmldom versions 0.9.11 to 0.9.12. To detect it, check the installed version of xmldom in your project using commands like 'npm list xmldom' or 'npm ls xmldom'. If the version is within the affected range, the system is vulnerable.

Impact Analysis

An attacker could exploit this to inject malicious XML content, potentially leading to data corruption, unauthorized access, or other security breaches in applications using affected xmldom versions. The impact depends on how the library is used in your system.

Compliance Impact

This vulnerability could compromise data integrity and security, potentially violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Exploitation may lead to unauthorized data access or modification.

Mitigation Strategies

Upgrade xmldom to version 0.9.12 or later immediately. Use commands like 'npm update xmldom' or modify package.json to specify the fixed version. Remove or replace any vulnerable instances if automatic updates are not feasible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83617. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart