CVE-2026-83609
published 2026-09-01CVE-2026-83609: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in…
PriorityP348high8.7CVSS 4.0
AVNACLATNPRNUINVCNVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.54%
45.3th percentile
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose later text injects markup when serialized through either the default path or requireWellFormed: true. The triggering ECMAScript line terminators are U+000A, U+000D, U+2028, and U+2029. This issue is fixed in @xmldom/xmldom version 0.9.12.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana | — | — |
| rhoai | odh-mlflow-rhel9 | — | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | >= 0.9.0 < 0.9.12 | 0.9.12 |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
ghsa·2026-09-08
CVE-2026-83609 [HIGH] CWE-625 xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
## Summary
An embedded line terminator bypasses xmldom's always-on, WHATWG-mandated creation-time name
validation. `createElementNS`, `createAttributeNS`, `createDocumentType`, and `createAttribute` should
reject a malformed qualified name with `InvalidCharacterError`, but a name whose first line is
well-formed slips through and enters the DOM. On serialization it is emitted verbatim, so the
characters after the line terminator inject markup into the output. The injection reaches the default
serialization path, and enabling `requireWellFormed` does not prevent it.
## Details
`createElementNS`, `createAttributeNS`, and `createDocumentType` r
VulDB
xmldom up to 0.9.11 lib/grammar.js createElementNS xml injection (Nessus ID 342310)
vuldb·2026-09-03·CVSS 8.7
CVE-2026-83609 [HIGH] xmldom up to 0.9.11 lib/grammar.js createElementNS xml injection (Nessus ID 342310)
A vulnerability labeled as critical has been found in xmldom up to 0.9.11. Affected by this vulnerability is the function createElementNS of the file lib/grammar.js. Such manipulation leads to xml injection.
This vulnerability is traded as CVE-2026-83609. The attack may be launched remotely. There is no exploit available.
The affected component should be upgraded.
Red Hat
@xmldom/xmldom: xmldom: Markup injection via embedded line terminators in XML names
vendor_redhat·2026-09-01·CVSS 8.7
CVE-2026-83609 [HIGH] CWE-91 @xmldom/xmldom: xmldom: Markup injection via embedded line terminators in XML names
@xmldom/xmldom: xmldom: Markup injection via embedded line terminators in XML names
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose later text injects markup when serialized through either the default path or requireWellFormed: true. The triggering ECMAScript line terminators are U+000A, U+000D, U+2028, and U+2029. This issue is fixed in @xmldom/xmldom version 0.9.12.
A flaw was foun
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-83609 jupyterlab: xmldom: Markup injection via embedded line terminators in XML names [epel-all]
bugzilla·2026-09-18·CVSS 8.7
CVE-2026-83609 [HIGH] CVE-2026-83609 jupyterlab: xmldom: Markup injection via embedded line terminators in XML names [epel-all]
CVE-2026-83609 jupyterlab: xmldom: Markup injection via embedded line terminators in XML names [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose later te
Bugzilla
CVE-2026-83609 kf6-breeze-icons: xmldom: Markup injection via embedded line terminators in XML names [epel-all]
bugzilla·2026-09-18·CVSS 8.7
CVE-2026-83609 [HIGH] CVE-2026-83609 kf6-breeze-icons: xmldom: Markup injection via embedded line terminators in XML names [epel-all]
CVE-2026-83609 kf6-breeze-icons: xmldom: Markup injection via embedded line terminators in XML names [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose la
Bugzilla
CVE-2026-83609 jupyterlab: xmldom: Markup injection via embedded line terminators in XML names [fedora-all]
bugzilla·2026-09-18·CVSS 8.7
CVE-2026-83609 [HIGH] CVE-2026-83609 jupyterlab: xmldom: Markup injection via embedded line terminators in XML names [fedora-all]
CVE-2026-83609 jupyterlab: xmldom: Markup injection via embedded line terminators in XML names [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose later
Bugzilla
CVE-2026-83609 crow-translate: xmldom: Markup injection via embedded line terminators in XML names [fedora-all]
bugzilla·2026-09-18·CVSS 8.7
CVE-2026-83609 [HIGH] CVE-2026-83609 crow-translate: xmldom: Markup injection via embedded line terminators in XML names [fedora-all]
CVE-2026-83609 crow-translate: xmldom: Markup injection via embedded line terminators in XML names [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose la
Bugzilla
CVE-2026-83609 kf6-breeze-icons: xmldom: Markup injection via embedded line terminators in XML names [fedora-all]
bugzilla·2026-09-18·CVSS 8.7
CVE-2026-83609 [HIGH] CVE-2026-83609 kf6-breeze-icons: xmldom: Markup injection via embedded line terminators in XML names [fedora-all]
CVE-2026-83609 kf6-breeze-icons: xmldom: Markup injection via embedded line terminators in XML names [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose
Bugzilla
CVE-2026-83609 onnxruntime: xmldom: Markup injection via embedded line terminators in XML names [fedora-all]
bugzilla·2026-09-18·CVSS 8.7
CVE-2026-83609 [HIGH] CVE-2026-83609 onnxruntime: xmldom: Markup injection via embedded line terminators in XML names [fedora-all]
CVE-2026-83609 onnxruntime: xmldom: Markup injection via embedded line terminators in XML names [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose later
Bugzilla
CVE-2026-83609 @xmldom/xmldom: xmldom: Markup injection via embedded line terminators in XML names
bugzilla·2026-09-01·CVSS 8.7
CVE-2026-83609 [HIGH] CVE-2026-83609 @xmldom/xmldom: xmldom: Markup injection via embedded line terminators in XML names
CVE-2026-83609 @xmldom/xmldom: xmldom: Markup injection via embedded line terminators in XML names
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose later text injects markup when serialized through either the default path or requireWellFormed: true. The triggering ECMAScript line terminators are U+000A, U+000D, U+2028, and U+2029. This issue is fixed in @xmldom/xmldom version 0.9.12.
2026-09-01
Published