CVE-2026-83618
published 2026-09-01CVE-2026-83618: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true…
PriorityP353high8.7CVSS 4.0
AVNACLATNPRNUINVCNVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.57%
46.4th percentile
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with PubidLiteral_match and SystemLiteral_match expressions produced by reg() in lib/grammar.js, which inherit the multiline flag. A complete valid literal on the first line can therefore satisfy the matcher while U+000A, U+000D, U+2028, or U+2029 and breakout markup remain in the emitted declaration. This bypasses the strict-serialization mitigation for the earlier DocumentType injection advisory; creation and direct property assignment remain unvalidated by design. This issue is fixed in @xmldom/xmldom version 0.9.12.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openshift4 | ose-console | — | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | >= 0.9.10 < 0.9.12 | 0.9.12 |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
xmldom: xmldom: DocumentType injection bypass via embedded line terminators
vendor_redhat·2026-09-01·CVSS 8.7
CVE-2026-83618 [HIGH] CWE-91 xmldom: xmldom: DocumentType injection bypass via embedded line terminators
xmldom: xmldom: DocumentType injection bypass via embedded line terminators
A flaw was found in xmldom, a JavaScript XML parser and serializer module. A remote attacker could bypass the `requireWellFormed` strict-serialization mitigation for DocumentType injection by embedding line terminators within the `publicId` or `systemId` of a DocumentType declaration. This allows for the injection of arbitrary markup into the XML output, potentially leading to data manipulation or other security impacts depending on how the XML is processed.
Package: openshift4/ose-console (Red Hat OpenShift Container Platform 4) - Affected
GHSA
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
ghsa·2026-09-08
CVE-2026-83618 [HIGH] CWE-625 xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
## Summary
An embedded line terminator bypasses the `requireWellFormed` serializer check for a `DocumentType`'s
publicId and systemId. The check was added to fix GHSA-f6ww-3ggp-fr8h; an id whose first line is a
valid literal slips past it and is emitted verbatim into the `` declaration, so the markup
after the line terminator breaks out into the surrounding document. Callers who enabled
`requireWellFormed` to neutralize DocumentType injection remain exposed.
## Details
`publicId` and `systemId` are stored as raw values **including their surrounding quotes**, and the
`PubidLiteral`/`SystemLiteral` productions include those quotes. The serializer validates them with
`g.PubidLitera
VulDB
xmldom up to 0.9.11 Serializer lib/grammar.js reg injection (Nessus ID 342300)
vuldb·2026-09-03·CVSS 8.7
CVE-2026-83618 [HIGH] xmldom up to 0.9.11 Serializer lib/grammar.js reg injection (Nessus ID 342300)
A vulnerability was found in xmldom up to 0.9.11. It has been declared as critical. Affected is the function reg of the file lib/grammar.js of the component Serializer. The manipulation results in injection.
This vulnerability is cataloged as CVE-2026-83618. The attack may be launched remotely. There is no exploit available.
It is recommended to upgrade the affected component.
No detection rules found.
No public exploits indexed.
https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362https://github.com/xmldom/xmldom/pull/1071https://github.com/xmldom/xmldom/releases/tag/0.9.12https://github.com/xmldom/xmldom/security/advisories/GHSA-vr34-hp96-76pphttps://github.com/xmldom/xmldom/security/advisories/GHSA-vr34-hp96-76pp
2026-09-01
Published