HavocPwn

Havoc-PWN（認証済み） このSSRF-RCEチェーンは、chebuya氏のCVE-2024-41570 SSRF POCとIncludeSecurity氏のHavoc Auth RCEに触発されて作成されました。両方のエクスプロイトは素晴らしく、よく作られています。これらの作成者の努力に感謝の意を表してください！ chebuya hyperreality どのように動作するのか？ SSRFの脆弱性は、デーモンエージェントの登録とチェックインを偽装して、チームサーバー上にTCPソケットを開き、そこからデータを読み書きすることで機能します。...

EUVD-2026-69241

xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator...

GHSA-27P8-2357-5QQV xmldom: DocType `name` Injection Bypasses requireWellFormed

Summary The @xmldom/xmldom serializer emits DocumentType.name verbatim into the declaration with no well-formedness guard. GHSA-f6ww-3ggp-fr8h CVE-2026-41674 hardened the serializer's requireWellFormed path for a DocumentType's sibling fields — publicId, systemId, and internalSubset — but it did...

xmldom: DocType `name` Injection Bypasses requireWellFormed

Summary The @xmldom/xmldom serializer emits DocumentType.name verbatim into the declaration with no well-formedness guard. GHSA-f6ww-3ggp-fr8h CVE-2026-41674 hardened the serializer's requireWellFormed path for a DocumentType's sibling fields — publicId, systemId, and internalSubset — but it did...

NPM: xmldom: Element name injection via createElement() bypasses requireWellFormed

NPM: xmldom: Element name injection via createElement bypasses requireWellFormed vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...

GHSA-W2RR-34G9-RVRJ xmldom: Element name injection via createElement() bypasses requireWellFormed

Summary Document.createElement in @xmldom/xmldom accepts arbitrary strings as the tagName parameter with zero validation. The serializer emits the tag name verbatim into XML/HTML output. Critically, the requireWellFormed: true serializer option — the recommended mitigation from CVE-2026-41672,...

GHSA-4W3W-2RP5-G8JM xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

Summary Element.setAttribute in @xmldom/xmldom bypasses attribute name validation by calling the private createAttributename method, which performs no validation. The public createAttribute method correctly validates names against an anchored QName pattern, but setAttribute never uses it. The...

xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

Summary Element.setAttribute in @xmldom/xmldom bypasses attribute name validation by calling the private createAttributename method, which performs no validation. The public createAttribute method correctly validates names against an anchored QName pattern, but setAttribute never uses it. The...

gitpython: GitPython: Arbitrary code execution via config-name injection

A flaw was found in GitPython. This vulnerability allows attackers to inject malicious configuration options by manipulating option names within the option-name validator. By injecting special characters, an attacker can forge arbitrary git-config directives, potentially leading to arbitrary code...

Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

Summary orval's zod client emits each schema property name as a double-quoted key in the generated zod.object... WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal context, where an injected computed property key expr is evaluated when zod.object...

SUSE CVE-2026-83617

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QNameexact expression produced by reg in lib/grammar.js, which inherits the multiline...

Linux Distros Unpatched Vulnerability : CVE-2026-83617

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true...

CVE-2026-83617 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QNameexact expression produced by reg in lib/grammar.js, which inherits the multiline...

CVE-2026-83617 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QNameexact expression produced by reg in lib/grammar.js, which inherits the multiline...

CVE-2026-83617 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QNameexact expression produced by reg in lib/grammar.js, which inherits the multiline...

CVE-2026-83608

xmldom (a pure JavaScript XML DOM module) is vulnerable to a DocType name injection that bypasses the requireWellFormed strict mode. The DOCUMENT_TYPE_NODE branch in lib/dom.js validates publicId, systemId, and internalSubset but emits DocumentType.name verbatim; a name containing > or whitesp...

CVE-2026-83607

xmldom , a pure JavaScript XML DOM module, is affected by an element name injection vulnerability. Prior to @xmldom/xmldom 0.8.14 and 0.9.11 , and in xmldom 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name that XMLSerializer.serializeToString() emits verbatim....

CVE-2026-83607 xmldom: Element name injection via createElement() bypasses requireWellFormed

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...

CVE-2026-83605

xmldom is a pure JavaScript W3C DOM Level 2 Core module. The vulnerability lies in Element.setAttribute() , which invokes the private _createAttribute(name) path without validating the attribute name against QName , unlike Document.createAttribute(). Because XMLSerializer.serializeToString() emit...

CVE-2026-83605 xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute calls the private createAttributename path without validating the attribute nam...