CVE-2026-83605
published 2026-09-01CVE-2026-83605: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11…
PriorityP352high8.7CVSS 4.0
AVNACLATNPRNUINVCNVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.61%
48.6th percentile
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private _createAttribute(name) path without validating the attribute name, while Document.createAttribute(name) validates against QName. XMLSerializer.serializeToString() emits attribute names verbatim, and requireWellFormed: true did not validate them, so a crafted name can terminate the intended attribute and inject additional attributes, including event handlers, into browser-consumed output; synthesized xmlns:PREFIX declarations expose the same unchecked-name boundary. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana | — | — |
| openshift4 | ose-console | — | — |
| rhdh | rhdh-hub-rhel9 | — | — |
| rhoai | odh-mlflow-rhel9 | — | — |
| xmldom | xmldom | <= 0.6.0 | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | 0 – 0.6.0 | — |
| xmldom | xmldom | >= 0.7.0 < 0.8.14 | 0.8.14 |
| xmldom | xmldom | >= 0.9.0 < 0.9.11 | 0.9.11 |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
ghsa·2026-09-08
CVE-2026-83605 [HIGH] CWE-91 xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
## Summary
`Element.setAttribute()` in `@xmldom/xmldom` bypasses attribute name validation by calling the private `_createAttribute(name)` method, which performs no validation. The public `createAttribute()` method correctly validates names against an anchored `QName` pattern, but `setAttribute()` never uses it. The serializer escapes attribute *values* but trusts attribute *names*, allowing an attacker to inject additional attributes (including event handlers) into serialized output. The `requireWellFormed: true` option did not catch this.
## Details
`Element.setAttribute(name, value)` creates attribute nodes by calling the private `_createAttribute(name)` method, which performs no validation on the `name`
Red Hat
xmldom: @xmldom/xmldom: xmldom: Attribute injection allows client-side script execution
vendor_redhat·2026-09-01·CVSS 8.7
CVE-2026-83605 [HIGH] CWE-79 xmldom: @xmldom/xmldom: xmldom: Attribute injection allows client-side script execution
xmldom: @xmldom/xmldom: xmldom: Attribute injection allows client-side script execution
A flaw was found in xmldom, a JavaScript XML DOM parser. The Element.setAttribute() function does not properly validate attribute names, allowing a remote attacker to inject specially crafted attribute names. This can lead to the injection of additional attributes, including event handlers, into browser-consumed output. Consequently, a remote attacker could achieve client-side script execution, such as Cross-Site Scripting (XSS), in the context of the affected application.
Package: rh-podman-desktop.git (Red Hat Build of Podman Desktop) - Affected
Package: rhdh/rhdh-hub-rhel9 (Red Hat Developer Hub) - Affected
Package: grafana (Red Hat Enterprise Linux 10) - Affected
Package: grafana (Red Hat Enter
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-83605 jupyterlab: xmldom: Attribute injection allows client-side script execution [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83605 [HIGH] CVE-2026-83605 jupyterlab: xmldom: Attribute injection allows client-side script execution [fedora-all]
CVE-2026-83605 jupyterlab: xmldom: Attribute injection allows client-side script execution [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private _createAttribute(name) path without validating the attribute name, while Document.createAttribute(name) validates against QName. XMLSerializer.serializeToString() emits attribute names verbatim, and requireWellFormed: true did not
Bugzilla
CVE-2026-83605 jupyterlab: xmldom: Attribute injection allows client-side script execution [epel-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83605 [HIGH] CVE-2026-83605 jupyterlab: xmldom: Attribute injection allows client-side script execution [epel-all]
CVE-2026-83605 jupyterlab: xmldom: Attribute injection allows client-side script execution [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private _createAttribute(name) path without validating the attribute name, while Document.createAttribute(name) validates against QName. XMLSerializer.serializeToString() emits attribute names verbatim, and requireWellFormed: true did not v
Bugzilla
CVE-2026-83605 kf6-breeze-icons: xmldom: Attribute injection allows client-side script execution [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83605 [HIGH] CVE-2026-83605 kf6-breeze-icons: xmldom: Attribute injection allows client-side script execution [fedora-all]
CVE-2026-83605 kf6-breeze-icons: xmldom: Attribute injection allows client-side script execution [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private _createAttribute(name) path without validating the attribute name, while Document.createAttribute(name) validates against QName. XMLSerializer.serializeToString() emits attribute names verbatim, and requireWellFormed: true d
Bugzilla
CVE-2026-83605 crow-translate: xmldom: Attribute injection allows client-side script execution [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83605 [HIGH] CVE-2026-83605 crow-translate: xmldom: Attribute injection allows client-side script execution [fedora-all]
CVE-2026-83605 crow-translate: xmldom: Attribute injection allows client-side script execution [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private _createAttribute(name) path without validating the attribute name, while Document.createAttribute(name) validates against QName. XMLSerializer.serializeToString() emits attribute names verbatim, and requireWellFormed: true did
Bugzilla
CVE-2026-83605 kf6-breeze-icons: xmldom: Attribute injection allows client-side script execution [epel-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83605 [HIGH] CVE-2026-83605 kf6-breeze-icons: xmldom: Attribute injection allows client-side script execution [epel-all]
CVE-2026-83605 kf6-breeze-icons: xmldom: Attribute injection allows client-side script execution [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private _createAttribute(name) path without validating the attribute name, while Document.createAttribute(name) validates against QName. XMLSerializer.serializeToString() emits attribute names verbatim, and requireWellFormed: true did
Bugzilla
CVE-2026-83605 onnxruntime: xmldom: Attribute injection allows client-side script execution [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83605 [HIGH] CVE-2026-83605 onnxruntime: xmldom: Attribute injection allows client-side script execution [fedora-all]
CVE-2026-83605 onnxruntime: xmldom: Attribute injection allows client-side script execution [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private _createAttribute(name) path without validating the attribute name, while Document.createAttribute(name) validates against QName. XMLSerializer.serializeToString() emits attribute names verbatim, and requireWellFormed: true did no
Bugzilla
CVE-2026-83605 xmldom: @xmldom/xmldom: xmldom: Attribute injection allows client-side script execution
bugzilla·2026-09-01·CVSS 8.7
CVE-2026-83605 [HIGH] CVE-2026-83605 xmldom: @xmldom/xmldom: xmldom: Attribute injection allows client-side script execution
CVE-2026-83605 xmldom: @xmldom/xmldom: xmldom: Attribute injection allows client-side script execution
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private _createAttribute(name) path without validating the attribute name, while Document.createAttribute(name) validates against QName. XMLSerializer.serializeToString() emits attribute names verbatim, and requireWellFormed: true did not validate them, so a crafted name can terminate the intended attribute and inject additional attributes, including event handlers, into browser-consumed output; synthesized xmlns:PREFIX declarations expose the same unchecked-n
https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172ehttps://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44https://github.com/xmldom/xmldom/pull/1043https://github.com/xmldom/xmldom/pull/1050https://github.com/xmldom/xmldom/releases/tag/0.8.14https://github.com/xmldom/xmldom/releases/tag/0.9.11https://github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jmhttps://github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jm
2026-09-01
Published