CVE-2026-83608
published 2026-09-01CVE-2026-83608: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12…
PriorityP355high8.7CVSS 4.0
AVNACLATNPRNUINVCNVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.61%
48.6th percentile
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENT_TYPE_NODE branch in lib/dom.js validates publicId, systemId, and internalSubset under requireWellFormed: true but emits DocumentType.name verbatim. A name containing > or whitespace can terminate the declaration and inject sibling markup; the value can be supplied through createDocumentType() on the 0.8.x and unscoped lines or through a direct DocumentType.name property write on every affected line. The default path and legacy creation-time behavior remain permissive, while the vulnerable strict path fails to enforce an XML Name. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana | — | — |
| openshift4 | ose-console | — | — |
| rhdh | rhdh-hub-rhel9 | — | — |
| rhoai | odh-mlflow-rhel9 | — | — |
| xmldom | xmldom | <= 0.6.0 | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | 0 – 0.6.0 | — |
| xmldom | xmldom | >= 0.7.0 < 0.8.15 | 0.8.15 |
| xmldom | xmldom | >= 0.9.0 < 0.9.12 | 0.9.12 |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa7.5HIGH
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
xmldom: DocType `name` Injection Bypasses requireWellFormed
ghsa·2026-09-08·CVSS 7.5
CVE-2026-83608 [HIGH] CWE-91 xmldom: DocType `name` Injection Bypasses requireWellFormed
xmldom: DocType `name` Injection Bypasses requireWellFormed
## Summary
The `@xmldom/xmldom` serializer emits `DocumentType.name` verbatim into the
`` declaration with no well-formedness guard. GHSA-f6ww-3ggp-fr8h
(CVE-2026-41674) hardened the serializer's `requireWellFormed` path for a
DocumentType's sibling fields — `publicId`, `systemId`, and `internalSubset` —
but it did **not** add any check for `name`. A `>` (or whitespace) in the name
terminates the doctype declaration early, letting the remaining characters
become sibling markup in the serialized output.
Because `requireWellFormed: true` — the recommended mitigation for the prior
xmldom injection CVEs — performs no validation on the DocType `name`, this is a
bypass of that control, in the same family as the open element-name
(GHS
Red Hat
xmldom: @xmldom/xmldom: xmldom: XML Markup Injection via DocType Name Bypass
vendor_redhat·2026-09-01·CVSS 8.7
CVE-2026-83608 [HIGH] CWE-91 xmldom: @xmldom/xmldom: xmldom: XML Markup Injection via DocType Name Bypass
xmldom: @xmldom/xmldom: xmldom: XML Markup Injection via DocType Name Bypass
A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. A remote attacker can exploit this vulnerability by providing a specially crafted `DocumentType.name` containing characters like `>` or whitespace. This bypasses the `requireWellFormed` validation, allowing the injection of arbitrary XML markup. Such injection can lead to unintended modifications of the XML document structure, potentially resulting in arbitrary code execution or information disclosure within applications that process the affected XML.
Package: rh-podman-desktop.git (Red Hat Build of Podman Desktop) - Affected
Package: rhdh/rhdh-hub-rhel9 (Red Hat Developer Hub) - Affected
Package: grafana (Red Hat Enterprise Linux
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-83608 jupyterlab: xmldom: XML Markup Injection via DocType Name Bypass [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83608 [HIGH] CVE-2026-83608 jupyterlab: xmldom: XML Markup Injection via DocType Name Bypass [fedora-all]
CVE-2026-83608 jupyterlab: xmldom: XML Markup Injection via DocType Name Bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENT_TYPE_NODE branch in lib/dom.js validates publicId, systemId, and internalSubset under requireWellFormed: true but emits DocumentType.name verbatim. A name containing > or whitespace can terminate the declaration and inject sibling markup; the value can be supplied thro
Bugzilla
CVE-2026-83608 kf6-breeze-icons: xmldom: XML Markup Injection via DocType Name Bypass [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83608 [HIGH] CVE-2026-83608 kf6-breeze-icons: xmldom: XML Markup Injection via DocType Name Bypass [fedora-all]
CVE-2026-83608 kf6-breeze-icons: xmldom: XML Markup Injection via DocType Name Bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENT_TYPE_NODE branch in lib/dom.js validates publicId, systemId, and internalSubset under requireWellFormed: true but emits DocumentType.name verbatim. A name containing > or whitespace can terminate the declaration and inject sibling markup; the value can be supplie
Bugzilla
CVE-2026-83608 crow-translate: xmldom: XML Markup Injection via DocType Name Bypass [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83608 [HIGH] CVE-2026-83608 crow-translate: xmldom: XML Markup Injection via DocType Name Bypass [fedora-all]
CVE-2026-83608 crow-translate: xmldom: XML Markup Injection via DocType Name Bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENT_TYPE_NODE branch in lib/dom.js validates publicId, systemId, and internalSubset under requireWellFormed: true but emits DocumentType.name verbatim. A name containing > or whitespace can terminate the declaration and inject sibling markup; the value can be supplied
Bugzilla
CVE-2026-83608 kf6-breeze-icons: xmldom: XML Markup Injection via DocType Name Bypass [epel-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83608 [HIGH] CVE-2026-83608 kf6-breeze-icons: xmldom: XML Markup Injection via DocType Name Bypass [epel-all]
CVE-2026-83608 kf6-breeze-icons: xmldom: XML Markup Injection via DocType Name Bypass [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENT_TYPE_NODE branch in lib/dom.js validates publicId, systemId, and internalSubset under requireWellFormed: true but emits DocumentType.name verbatim. A name containing > or whitespace can terminate the declaration and inject sibling markup; the value can be supplied
Bugzilla
CVE-2026-83608 onnxruntime: xmldom: XML Markup Injection via DocType Name Bypass [fedora-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83608 [HIGH] CVE-2026-83608 onnxruntime: xmldom: XML Markup Injection via DocType Name Bypass [fedora-all]
CVE-2026-83608 onnxruntime: xmldom: XML Markup Injection via DocType Name Bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENT_TYPE_NODE branch in lib/dom.js validates publicId, systemId, and internalSubset under requireWellFormed: true but emits DocumentType.name verbatim. A name containing > or whitespace can terminate the declaration and inject sibling markup; the value can be supplied thr
Bugzilla
CVE-2026-83608 jupyterlab: xmldom: XML Markup Injection via DocType Name Bypass [epel-all]
bugzilla·2026-09-02·CVSS 8.7
CVE-2026-83608 [HIGH] CVE-2026-83608 jupyterlab: xmldom: XML Markup Injection via DocType Name Bypass [epel-all]
CVE-2026-83608 jupyterlab: xmldom: XML Markup Injection via DocType Name Bypass [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENT_TYPE_NODE branch in lib/dom.js validates publicId, systemId, and internalSubset under requireWellFormed: true but emits DocumentType.name verbatim. A name containing > or whitespace can terminate the declaration and inject sibling markup; the value can be supplied throug
Bugzilla
CVE-2026-83608 xmldom: @xmldom/xmldom: xmldom: XML Markup Injection via DocType Name Bypass
bugzilla·2026-09-01·CVSS 8.7
CVE-2026-83608 [HIGH] CVE-2026-83608 xmldom: @xmldom/xmldom: xmldom: XML Markup Injection via DocType Name Bypass
CVE-2026-83608 xmldom: @xmldom/xmldom: xmldom: XML Markup Injection via DocType Name Bypass
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENT_TYPE_NODE branch in lib/dom.js validates publicId, systemId, and internalSubset under requireWellFormed: true but emits DocumentType.name verbatim. A name containing > or whitespace can terminate the declaration and inject sibling markup; the value can be supplied through createDocumentType() on the 0.8.x and unscoped lines or through a direct DocumentType.name property write on every affected line. The default path and legacy creation-time behavior remain permissive, while the vulnerable s
https://github.com/xmldom/xmldom/commit/57aec90ac57b4408ae7c5d1746bf2a693b5ed90ehttps://github.com/xmldom/xmldom/commit/85f12eb4d14b44de33216cfb72b50af4d24e9fddhttps://github.com/xmldom/xmldom/pull/1071https://github.com/xmldom/xmldom/pull/1072https://github.com/xmldom/xmldom/releases/tag/0.8.15https://github.com/xmldom/xmldom/releases/tag/0.9.12https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqvhttps://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv
2026-09-01
Published