9 matches found
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
Summary Element.setAttribute in @xmldom/xmldom bypasses attribute name validation by calling the private createAttributename method, which performs no validation. The public createAttribute method correctly validates names against an anchored QName pattern, but setAttribute never uses it. The...
GHSA-4W3W-2RP5-G8JM xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
Summary Element.setAttribute in @xmldom/xmldom bypasses attribute name validation by calling the private createAttributename method, which performs no validation. The public createAttribute method correctly validates names against an anchored QName pattern, but setAttribute never uses it. The...
CVE-2026-83617 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QNameexact expression produced by reg in lib/grammar.js, which inherits the multiline...
CVE-2026-83605
xmldom is a pure JavaScript W3C DOM Level 2 Core module. The vulnerability lies in Element.setAttribute() , which invokes the private _createAttribute(name) path without validating the attribute name against QName , unlike Document.createAttribute(). Because XMLSerializer.serializeToString() emit...
CVE-2026-83605 xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute calls the private createAttributename path without validating the attribute nam...
PT-2026-84281
Name of the Vulnerable Software and Affected Versions xmldom versions 0.9.11 through 0.9.11 Description The requireWellFormed: true element and attribute name checks use an anchored QName exact expression produced by the reg function in lib/grammar.js that inherits the multiline flag. This allows...
PT-2026-51785
Name of the Vulnerable Software and Affected Versions hono versions prior to 4.12.14 Description An HTML injection issue exists in the JSX server-side rendering SSR process. Attackers can inject unintended HTML by using malformed attribute names. By crafting attribute keys that include characters...
