xmldom: Creation-time XML Name/QName validation is bypassable

Published September 8, 2026 CVE-2026-83609

Applications using vulnerable xmldom releases can let attackers insert unwanted markup into generated XML. If that output enters a web page, attacker-supplied code can run in visitors' browsers.

Severity
HighCVSS 4.0 · 8.7
Fix
Fixed in 0.9.12Fix recorded 2 days ago
Affected versions
0.9.0 or newer, but before 0.9.12
Weakness
CWE-91XML Injection
Exploit likelihood
0.33% in 30 daysEPSS, higher than 25% of known flaws
Affects
xmldom

How it works

  • An application first passes attacker-controlled text into an affected element, attribute, or document-type naming function.
  • The attacker places a line break after a valid first line, followed by unwanted markup. xmldom checks the valid line but accepts and stores the entire name.
  • Converting the XML structure back to text then includes the unwanted markup unchanged.
  • The stricter output option does not prevent this.

What to do

Run npm list @xmldom/xmldom inside the application directory and inspect nested copies. A result from 0.9.0 through 0.9.11 means vulnerable code is installed. Actual exposure also requires untrusted text to reach an affected name-creation function and the resulting XML structure to be serialized. This result does not prove the flaw was exploited.

Run this in the application environment you want to check:

npm list @xmldom/xmldom

Move every affected copy to the patched 0.9.12 release using the project's existing dependency process. Then repeat the version check and confirm no copy from 0.9.0 through 0.9.11 remains.

Technical details

A shared regular expression incorrectly used multiline matching. QName validation could therefore approve a valid first line while ignoring attacker-controlled text after a line break. The affected creation functions stored the entire name. XMLSerializer then emitted it unchanged on both the default path and with requireWellFormed: true.

Cross-site scripting is possible when an application places the serialized output into HTML.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure None No data disclosure
  • Vulnerable system: Data changes High Protected data can be changed with serious impact
  • Vulnerable system: Service disruption None No availability impact
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source