CLSA-2026-1791028067 TuxCare security update for @xmldom/xmldom (3 CVEs)

TuxCare rebuilt @xmldom/xmldom to address 3 CVEs. Fixed in 0.9.8-tuxcare.1...

CLSA-2026-1790760268 TuxCare security update for @xmldom/xmldom (4 CVEs)

TuxCare rebuilt @xmldom/xmldom to address 4 CVEs. Fixed in 0.9.10-tuxcare.2...

CLSA-2026-1790755546 TuxCare security update for @xmldom/xmldom (14 CVEs)

TuxCare rebuilt @xmldom/xmldom to address 14 CVEs. Fixed in 0.7.13-tuxcare.1...

ROOT-APP-NPM-CVE-2026-83619 CVE-2026-83619 in @xmldom/xmldom - Patched by Root

Root has patched CVE-2026-83619 in the @xmldom/xmldom package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-83614 CVE-2026-83614 in @xmldom/xmldom - Patched by Root

Root has patched CVE-2026-83614 in the @xmldom/xmldom package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-83616 CVE-2026-83616 in @xmldom/xmldom - Patched by Root

Root has patched CVE-2026-83616 in the @xmldom/xmldom package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-83607 CVE-2026-83607 in @xmldom/xmldom - Patched by Root

Root has patched CVE-2026-83607 in the @xmldom/xmldom package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-83615 CVE-2026-83615 in @xmldom/xmldom - Patched by Root

Root has patched CVE-2026-83615 in the @xmldom/xmldom package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-83605 CVE-2026-83605 in @xmldom/xmldom - Patched by Root

Root has patched CVE-2026-83605 in the @xmldom/xmldom package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-83613 CVE-2026-83613 in @xmldom/xmldom - Patched by Root

Root has patched CVE-2026-83613 in the @xmldom/xmldom package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-83608 CVE-2026-83608 in @xmldom/xmldom - Patched by Root

Root has patched CVE-2026-83608 in the @xmldom/xmldom package for Root:npm. Multiple fixed versions available...

CLSA-2026-1790608669 TuxCare security update for @xmldom/xmldom (9 CVEs)

TuxCare rebuilt @xmldom/xmldom to address 9 CVEs. Fixed in 0.9.10-tuxcare.1...

CVE-2026-83617

A flaw was found in the @xmldom/xmldom library. The requireWellFormed validation for XML element and attribute names can be bypassed by embedding specific line terminator characters. This allows an attacker to inject malformed XML into the document, potentially leading to XML injection...

ROOT-APP-NPM-GHSA-4W3W-2RP5-G8JM GHSA-4w3w-2rp5-g8jm in @xmldom/xmldom - Patched by Root

Root has patched GHSA-4w3w-2rp5-g8jm in the @xmldom/xmldom package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-83612 CVE-2026-83612 in @xmldom/xmldom - Patched by Root

Root has patched CVE-2026-83612 in the @xmldom/xmldom package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-83618 CVE-2026-83618 in @xmldom/xmldom - Patched by Root

Root has patched CVE-2026-83618 in the @xmldom/xmldom package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-83609 CVE-2026-83609 in @xmldom/xmldom - Patched by Root

Root has patched CVE-2026-83609 in the @xmldom/xmldom package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-83617 CVE-2026-83617 in @xmldom/xmldom - Patched by Root

Root has patched CVE-2026-83617 in the @xmldom/xmldom package for Root:npm. Multiple fixed versions available...

GHSA-C7Q8-3CH8-VQPV xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

Summary Document.createProcessingInstruction in @xmldom/xmldom performs no validation on the target parameter. The requireWellFormed: true serializer option validates only for : in the target and a case-insensitive xml prefix, but does not check for characters. A in the target breaks the processi...

6thbridge-hexa-docs (0.0.1), @12-labours/mapintegratedvuer (>=1.0.0-beta.0, <=1.0.0-beta.14) +1069 more potentially affected by CVE-2026-83616 via @xmldom/xmldom (>=0.9.0, <=0.9.11)

@xmldom/xmldom NPM version =0.9.0, =1.0.0-beta.0, =0.0.1, =0.0.1, =0.0.1, =2.4.4, =0.1.30-develop-map-0, =0.1.0, =0.3.2-beta.0, =2.0.2, =0.8.1, =0.1.0, =0.1.0, =0.2.2 - @aidin36/xmp2js 1.0.0 and more Source cves: CVE-2026-83616 Source advisory: OSV:GHSA-C7Q8-3CH8-VQPV...