CVE-2026-83617
published 2026-09-01CVE-2026-83617: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true…
PriorityP352high8.7CVSS 4.0
AVNACLATNPRNUINVCNVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.57%
46.4th percentile
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QName_exact expression produced by reg() in lib/grammar.js, which inherits the multiline flag. A name with a valid first line followed by U+000A, U+000D, U+2028, or U+2029 and breakout markup therefore passes validation and is emitted verbatim in element start and end tags or attribute names. This bypasses the strict-serialization checks introduced for the earlier element-name and attribute-name injection advisories, while the default serialization path remains outside the strict guarantee. This issue is fixed in @xmldom/xmldom version 0.9.12.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana | — | — |
| rhoai | odh-mlflow-rhel9 | — | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | >= 0.9.11 < 0.9.12 | 0.9.12 |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
ghsa·2026-09-08
CVE-2026-83617 [HIGH] CWE-625 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
## Summary
An embedded line terminator bypasses the `requireWellFormed` serializer check for element and
attribute names. The check was added to fix GHSA-w2rr-34g9-rvrj and GHSA-4w3w-2rp5-g8jm; a name whose
first line is well-formed slips past it and is serialized verbatim, so the characters after the line
terminator break out of the start/end tag or attribute. Callers who enabled `requireWellFormed`
specifically to neutralize those name-injection issues remain exposed.
## Details
xmldom builds every grammar production through a shared regexp builder that compiles with the `m`
flag. The anchored full-string matcher used for element and attribute names, `QName_exact =
reg('^', QName
Red Hat
@xmldom/xmldom: xmldom: XML injection via embedded line terminator in element/attribute names
vendor_redhat·2026-09-01·CVSS 8.7
CVE-2026-83617 [HIGH] CWE-91 @xmldom/xmldom: xmldom: XML injection via embedded line terminator in element/attribute names
@xmldom/xmldom: xmldom: XML injection via embedded line terminator in element/attribute names
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QName_exact expression produced by reg() in lib/grammar.js, which inherits the multiline flag. A name with a valid first line followed by U+000A, U+000D, U+2028, or U+2029 and breakout markup therefore passes validation and is emitted verbatim in element start and end tags or attribute names. This bypasses the strict-serialization checks introduced for the earlier element-name and attribute-name injection advisories, while the default serialization path remains outside the strict guarantee
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-83617 onnxruntime: xmldom: XML injection via embedded line terminator in element/attribute names [fedora-all]
bugzilla·2026-09-18·CVSS 8.7
CVE-2026-83617 [HIGH] CVE-2026-83617 onnxruntime: xmldom: XML injection via embedded line terminator in element/attribute names [fedora-all]
CVE-2026-83617 onnxruntime: xmldom: XML injection via embedded line terminator in element/attribute names [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QName_exact expression produced by reg() in lib/grammar.js, which inherits the multiline flag. A name with a valid first line followed by U+000A, U+000D, U+2028, or U+2029 and breakout markup therefore passes validation and is emitted verbatim
Bugzilla
CVE-2026-83617 crow-translate: xmldom: XML injection via embedded line terminator in element/attribute names [fedora-all]
bugzilla·2026-09-18·CVSS 8.7
CVE-2026-83617 [HIGH] CVE-2026-83617 crow-translate: xmldom: XML injection via embedded line terminator in element/attribute names [fedora-all]
CVE-2026-83617 crow-translate: xmldom: XML injection via embedded line terminator in element/attribute names [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QName_exact expression produced by reg() in lib/grammar.js, which inherits the multiline flag. A name with a valid first line followed by U+000A, U+000D, U+2028, or U+2029 and breakout markup therefore passes validation and is emitted verbat
Bugzilla
CVE-2026-83617 kf6-breeze-icons: xmldom: XML injection via embedded line terminator in element/attribute names [fedora-all]
bugzilla·2026-09-18·CVSS 8.7
CVE-2026-83617 [HIGH] CVE-2026-83617 kf6-breeze-icons: xmldom: XML injection via embedded line terminator in element/attribute names [fedora-all]
CVE-2026-83617 kf6-breeze-icons: xmldom: XML injection via embedded line terminator in element/attribute names [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QName_exact expression produced by reg() in lib/grammar.js, which inherits the multiline flag. A name with a valid first line followed by U+000A, U+000D, U+2028, or U+2029 and breakout markup therefore passes validation and is emitted verb
Bugzilla
CVE-2026-83617 kf6-breeze-icons: xmldom: XML injection via embedded line terminator in element/attribute names [epel-all]
bugzilla·2026-09-18·CVSS 8.7
CVE-2026-83617 [HIGH] CVE-2026-83617 kf6-breeze-icons: xmldom: XML injection via embedded line terminator in element/attribute names [epel-all]
CVE-2026-83617 kf6-breeze-icons: xmldom: XML injection via embedded line terminator in element/attribute names [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QName_exact expression produced by reg() in lib/grammar.js, which inherits the multiline flag. A name with a valid first line followed by U+000A, U+000D, U+2028, or U+2029 and breakout markup therefore passes validation and is emitted verbat
Bugzilla
CVE-2026-83617 jupyterlab: xmldom: XML injection via embedded line terminator in element/attribute names [epel-all]
bugzilla·2026-09-18·CVSS 8.7
CVE-2026-83617 [HIGH] CVE-2026-83617 jupyterlab: xmldom: XML injection via embedded line terminator in element/attribute names [epel-all]
CVE-2026-83617 jupyterlab: xmldom: XML injection via embedded line terminator in element/attribute names [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QName_exact expression produced by reg() in lib/grammar.js, which inherits the multiline flag. A name with a valid first line followed by U+000A, U+000D, U+2028, or U+2029 and breakout markup therefore passes validation and is emitted verbatim in
Bugzilla
CVE-2026-83617 jupyterlab: xmldom: XML injection via embedded line terminator in element/attribute names [fedora-all]
bugzilla·2026-09-18·CVSS 8.7
CVE-2026-83617 [HIGH] CVE-2026-83617 jupyterlab: xmldom: XML injection via embedded line terminator in element/attribute names [fedora-all]
CVE-2026-83617 jupyterlab: xmldom: XML injection via embedded line terminator in element/attribute names [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QName_exact expression produced by reg() in lib/grammar.js, which inherits the multiline flag. A name with a valid first line followed by U+000A, U+000D, U+2028, or U+2029 and breakout markup therefore passes validation and is emitted verbatim i
Bugzilla
CVE-2026-83617 @xmldom/xmldom: xmldom: XML injection via embedded line terminator in element/attribute names
bugzilla·2026-09-01·CVSS 8.7
CVE-2026-83617 [HIGH] CVE-2026-83617 @xmldom/xmldom: xmldom: XML injection via embedded line terminator in element/attribute names
CVE-2026-83617 @xmldom/xmldom: xmldom: XML injection via embedded line terminator in element/attribute names
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QName_exact expression produced by reg() in lib/grammar.js, which inherits the multiline flag. A name with a valid first line followed by U+000A, U+000D, U+2028, or U+2029 and breakout markup therefore passes validation and is emitted verbatim in element start and end tags or attribute names. This bypasses the strict-serialization checks introduced for the earlier element-name and attribute-name injection advisories, while the default serialization path remains outside the s
https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362https://github.com/xmldom/xmldom/pull/1071https://github.com/xmldom/xmldom/releases/tag/0.9.12https://github.com/xmldom/xmldom/security/advisories/GHSA-jxjr-3g7g-3944https://github.com/xmldom/xmldom/security/advisories/GHSA-jxjr-3g7g-3944
2026-09-01
Published