CVE-2026-83609

Name of the Vulnerable Software and Affected Versions xmldom versions 0.9.0 through 0.9.11

Description The shared reg() builder in lib/grammar.js compiles the anchored QName exact validator using the multiline flag. This causes the ^ and $ anchors to validate only a single line rather than the entire name. Consequently, the functions createElementNS(), createAttributeNS(), createDocumentType(), and createAttribute() may accept malformed XML names where the first line is valid but subsequent text injects markup during serialization via the default path or when requireWellFormed is set to true. This behavior is triggered by ECMAScript line terminators U+000A, U+000D, U+2028, and U+2029.

Recommendations Update to version 0.9.12.