PT-2026-84273 · Npm · Xmldom
CVE-2026-83609
·
Published
2026-08-22
·
Updated
2026-09-08
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
xmldom versions 0.9.0 through 0.9.11
Description
The shared
reg() builder in lib/grammar.js compiles the anchored QName exact validator using the multiline flag. This causes the ^ and $ anchors to validate only a single line rather than the entire name. Consequently, the functions createElementNS(), createAttributeNS(), createDocumentType(), and createAttribute() may accept malformed XML names where the first line is valid but subsequent text injects markup during serialization via the default path or when requireWellFormed is set to true. This behavior is triggered by ECMAScript line terminators U+000A, U+000D, U+2028, and U+2029.Recommendations
Update to version 0.9.12.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Xmldom