CVE-2026-83607

Name of the Vulnerable Software and Affected Versions @xmldom/xmldom versions prior to 0.8.14 @xmldom/xmldom versions prior to 0.9.11 xmldom versions 0.6.0 and earlier

Description The Document.createElement(tagName) function stores an unvalidated element name, which is then emitted verbatim by XMLSerializer.serializeToString(). When the requireWellFormed: true path is used, it fails to validate the element qualified name or the synthesized xmlns:PREFIX declaration. This allows attacker-controlled tag names to inject attributes, elements, or processing instructions into serialized XML or HTML, potentially leading to cross-site scripting (XSS) when the output is consumed by a browser. These unchecked values violate the XML QName (Qualified Name) constraint, which defines the rules for naming elements and attributes in XML.

Recommendations Update @xmldom/xmldom to version 0.8.14. Update @xmldom/xmldom to version 0.9.11. At the moment, there is no information about a newer version that contains a fix for this vulnerability.