CVE-2026-83607
published 2026-09-01CVE-2026-83607: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11…
PriorityP350high8.7CVSS 4.0
AVNACLATNPRNUINVCNVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.61%
48.6th percentile
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-controlled tag names could inject attributes, elements, or processing instructions into serialized XML or HTML and could cause cross-site scripting when browser-consumed. The unchecked values violate the XML QName constraint, and default serialization and creation-time createElement() behavior remain permissive. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openshift4 | ose-console | — | — |
| xmldom | xmldom | <= 0.6.0 | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | 0 – 0.6.0 | — |
| xmldom | xmldom | >= 0.7.0 < 0.8.14 | 0.8.14 |
| xmldom | xmldom | >= 0.9.0 < 0.9.11 | 0.9.11 |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa7.5HIGH
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
xmldom: xmldom: Cross-site scripting via unvalidated element name injection
vendor_redhat·2026-09-01·CVSS 8.7
CVE-2026-83607 [HIGH] CWE-79 xmldom: xmldom: Cross-site scripting via unvalidated element name injection
xmldom: xmldom: Cross-site scripting via unvalidated element name injection
A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. This vulnerability allows a remote attacker to inject malicious content, such as attributes or elements, into serialized XML or HTML documents. This occurs because the `Document.createElement()` function does not properly validate element names, and the `XMLSerializer.serializeToString()` function then outputs these unvalidated names directly. When these manipulated documents are processed by a web browser, it can lead to cross-site scripting (XSS), enabling attackers to execute arbitrary scripts in the user's browser.
Package: openshift4/ose-console (Red Hat OpenShift Container Platform 4) - Affected
GHSA
xmldom: Element name injection via createElement() bypasses requireWellFormed
ghsa·2026-09-08·CVSS 7.5
CVE-2026-83607 [HIGH] CWE-91 xmldom: Element name injection via createElement() bypasses requireWellFormed
xmldom: Element name injection via createElement() bypasses requireWellFormed
## Summary
`Document.createElement()` in `@xmldom/xmldom` accepts arbitrary strings as the `tagName` parameter with zero validation. The serializer emits the tag name verbatim into XML/HTML output. Critically, the `requireWellFormed: true` serializer option — the recommended mitigation from CVE-2026-41672, CVE-2026-41674, and CVE-2026-34601 — did NOT catch this, making it a bypass of the existing security controls.
An attacker who controls the element name string can inject arbitrary attributes (including event handlers) into the serialized output, leading to XSS when the output is consumed by a browser or downstream parser.
## Details
`Document.createElement()` accepts any string as `tagName` and stores it
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-83607 kf6-breeze-icons: xmldom: Cross-site scripting via unvalidated element name injection [epel-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83607 [HIGH] CVE-2026-83607 kf6-breeze-icons: xmldom: Cross-site scripting via unvalidated element name injection [epel-all]
CVE-2026-83607 kf6-breeze-icons: xmldom: Cross-site scripting via unvalidated element name injection [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-co
Bugzilla
CVE-2026-83607 crow-translate: xmldom: Cross-site scripting via unvalidated element name injection [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83607 [HIGH] CVE-2026-83607 crow-translate: xmldom: Cross-site scripting via unvalidated element name injection [fedora-all]
CVE-2026-83607 crow-translate: xmldom: Cross-site scripting via unvalidated element name injection [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-co
Bugzilla
CVE-2026-83607 onnxruntime: xmldom: Cross-site scripting via unvalidated element name injection [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83607 [HIGH] CVE-2026-83607 onnxruntime: xmldom: Cross-site scripting via unvalidated element name injection [fedora-all]
CVE-2026-83607 onnxruntime: xmldom: Cross-site scripting via unvalidated element name injection [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-contr
Bugzilla
CVE-2026-83607 kf6-breeze-icons: xmldom: Cross-site scripting via unvalidated element name injection [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83607 [HIGH] CVE-2026-83607 kf6-breeze-icons: xmldom: Cross-site scripting via unvalidated element name injection [fedora-all]
CVE-2026-83607 kf6-breeze-icons: xmldom: Cross-site scripting via unvalidated element name injection [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-
Bugzilla
CVE-2026-83607 mathjax3: xmldom: Cross-site scripting via unvalidated element name injection [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83607 [HIGH] CVE-2026-83607 mathjax3: xmldom: Cross-site scripting via unvalidated element name injection [fedora-all]
CVE-2026-83607 mathjax3: xmldom: Cross-site scripting via unvalidated element name injection [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-controll
Bugzilla
CVE-2026-83607 jupyterlab: xmldom: Cross-site scripting via unvalidated element name injection [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83607 [HIGH] CVE-2026-83607 jupyterlab: xmldom: Cross-site scripting via unvalidated element name injection [fedora-all]
CVE-2026-83607 jupyterlab: xmldom: Cross-site scripting via unvalidated element name injection [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-contro
Bugzilla
CVE-2026-83607 mathjax3: xmldom: Cross-site scripting via unvalidated element name injection [epel-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83607 [HIGH] CVE-2026-83607 mathjax3: xmldom: Cross-site scripting via unvalidated element name injection [epel-all]
CVE-2026-83607 mathjax3: xmldom: Cross-site scripting via unvalidated element name injection [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-controlled
Bugzilla
CVE-2026-83607 jupyterlab: xmldom: Cross-site scripting via unvalidated element name injection [epel-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83607 [HIGH] CVE-2026-83607 jupyterlab: xmldom: Cross-site scripting via unvalidated element name injection [epel-all]
CVE-2026-83607 jupyterlab: xmldom: Cross-site scripting via unvalidated element name injection [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-controll
Bugzilla
CVE-2026-83607 xmldom: xmldom: Cross-site scripting via unvalidated element name injection
bugzilla·2026-09-01·CVSS 8.7
CVE-2026-83607 [HIGH] CVE-2026-83607 xmldom: xmldom: Cross-site scripting via unvalidated element name injection
CVE-2026-83607 xmldom: xmldom: Cross-site scripting via unvalidated element name injection
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-controlled tag names could inject attributes, elements, or processing instructions into serialized XML or HTML and could cause cross-site scripting when browser-consumed. The unchecked values violate the XML QName constraint, and default serializat
https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172ehttps://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44https://github.com/xmldom/xmldom/pull/1043https://github.com/xmldom/xmldom/pull/1050https://github.com/xmldom/xmldom/releases/tag/0.8.14https://github.com/xmldom/xmldom/releases/tag/0.9.11https://github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrjhttps://github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj
2026-09-01
Published