6thbridge-hexa-docs (0.0.1), @12-labours/mapintegratedvuer (>=1.0.0-beta.0, <=1.0.0-beta.14) +1089 more potentially affected by CVE-2026-83605 via @xmldom/xmldom (>=0.9.0, <=0.9.10)

@xmldom/xmldom NPM version =0.9.0, =1.0.0-beta.0, =0.0.1, =0.0.1, =0.0.1, =2.4.4, =0.1.30-develop-map-0, =0.1.0, =0.3.2-beta.0, =2.0.2, =0.8.1, =0.1.0, =0.8.0, =0.1.0, =0.2.2 and more Source cves: CVE-2026-83605 Source advisory: OSV:GHSA-4W3W-2RP5-G8JM...

EUVD-2026-69215

xmldom: Attribute name injection via setAttribute bypasses requireWellFormed...

xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

Summary Element.setAttribute in @xmldom/xmldom bypasses attribute name validation by calling the private createAttributename method, which performs no validation. The public createAttribute method correctly validates names against an anchored QName pattern, but setAttribute never uses it. The...

GHSA-4W3W-2RP5-G8JM xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

Summary Element.setAttribute in @xmldom/xmldom bypasses attribute name validation by calling the private createAttributename method, which performs no validation. The public createAttribute method correctly validates names against an anchored QName pattern, but setAttribute never uses it. The...

08cms (1.0.0), 0uth (>=1.0.5, <=1.2.1) +12683 more potentially affected by CVE-2026-83605 via xmldom (>=0.1.2, <=0.6.0)

xmldom NPM version =0.1.2, =1.0.5, =1.0.0, =1.0.0, =1.7.3, =0.1.0, =0.0.2, =0.0.1, =1.0.2, =1.0.3, =1.0.23, =1.0.1, =1.3.1 and more Source cves: CVE-2026-83605 Source advisory: OSV:GHSA-4W3W-2RP5-G8JM...

08cms (1.0.0), 0uth (>=1.0.5, <=1.2.1) +12683 more potentially affected by CVE-2026-83605 via xmldom (>=0.1.2, <=0.6.0)

xmldom NPM version =0.1.2, =1.0.5, =1.0.0, =1.0.0, =1.7.3, =0.1.0, =0.0.2, =0.0.1, =1.0.2, =1.0.3, =1.0.23, =1.0.1, =1.3.1 and more Source cves: CVE-2026-83605 Source advisory: GHSA-4W3W-2RP5-G8JM...

CLSA-2026-1788561202 TuxCare security update for xmldom (1 CVE)

TuxCare rebuilt xmldom to address 1 CVE. Fixed in 0.1.31-tuxcare.4...

PT-2026-91826

TuxCare rebuilt xmldom to address 1 CVE. Fixed in 0.1.31-tuxcare.4...

lib/sax.js XML DOM Buffer Overflow DoS

The vulnerability of the parseElementStartPart function in the lib/sax.js file, a module for defining methods to access and manage XML documents, is related to algorithmic complexity. Exploiting this vulnerability could allow an attacker to cause service failures remotely...

lib/dom-parser.js XMLDOM DoS

The vulnerability of the DOMHandler.startElement method in the lib/dom-parser.js file of the XML document access and manipulation module called XMLDOM is related to algorithmic complexity. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

XMLDOM Document.createElement() XSS

The vulnerability of the Document.createElement function in the XML document access and management module, XMLDOM, is related to errors in processing XML requests. Exploiting this vulnerability allows an attacker to bypass existing security mechanisms and perform cross-site scripting attacks XSS...

lib/grammar.js XML DOM DoS

The vulnerability of the lib/grammar.js file, which is part of the module for determining access methods to XML documents and managing them via XMLDOM, involves an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

XMLDOM XSS

The vulnerability of the Element.setAttribute method in the XML document access and manipulation module XMLDOM is related to errors in processing XML requests. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

lib/sax.js XML DOM DoS

The vulnerability of the lib/sax.js file, which is part of the XML document access and management module XMLDOM, involves an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

XMLDOM DOMParser parseFromString DoS

The vulnerability of the DOMParser.parseFromString method in the XML method of accessing and managing documents involves an uncontrolled consumption of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures...

lib/dom.js Processing Instruction Data Compromise

The vulnerability of the Document.createProcessingInstruction method in the lib/dom.js module, which is part of the XML document access and manipulation mechanism implemented by XMLDOM, is related to errors in processing XML requests. Exploiting this vulnerability could allow an attacker to...

XMLDOM XML Data Compromise

The vulnerability of the serialization for XML documents related to access control and management is related to the use of regular expressions, which do not sufficiently restrict the set of allowed values. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of...

XMLDOM appendElement Function DoS

The vulnerability of the appendElement function in the XML document access and management module XMLDOM is related to unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

CVE-2026-83610

creationtimestamp| type| source ---|---|--- 2026-09-02 16:35:11+00:00| published-proof-of-concept| https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6...

6thbridge-hexa-docs (0.0.1), @12-labours/mapintegratedvuer (>=1.0.0-beta.0, <=1.0.0-beta.14) +1091 more potentially affected by CVE-2026-83610 via @xmldom/xmldom (>=0.9.0, <=0.9.11)

@xmldom/xmldom NPM version =0.9.0, =1.0.0-beta.0, =0.0.1, =0.0.1, =0.0.1, =2.4.4, =0.1.30-develop-map-0, =0.1.0, =0.3.2-beta.0, =2.0.2, =0.8.1, =0.1.0, =0.8.0, =0.1.0, =0.2.2 and more Source cves: CVE-2026-83610 Source advisory: OSV:GHSA-6GMQ-8VP8-GCM6...