26 matches found
EUVD-2026-69217
xmldom: Element name injection via createElement bypasses requireWellFormed...
NPM: xmldom: Element name injection via createElement() bypasses requireWellFormed
NPM: xmldom: Element name injection via createElement bypasses requireWellFormed vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...
xmldom: Element name injection via createElement() bypasses requireWellFormed
Summary Document.createElement in @xmldom/xmldom accepts arbitrary strings as the tagName parameter with zero validation. The serializer emits the tag name verbatim into XML/HTML output. Critically, the requireWellFormed: true serializer option — the recommended mitigation from CVE-2026-41672,...
GHSA-W2RR-34G9-RVRJ xmldom: Element name injection via createElement() bypasses requireWellFormed
Summary Document.createElement in @xmldom/xmldom accepts arbitrary strings as the tagName parameter with zero validation. The serializer emits the tag name verbatim into XML/HTML output. Critically, the requireWellFormed: true serializer option — the recommended mitigation from CVE-2026-41672,...
SUSE CVE-2026-83607
xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...
Linux Distros Unpatched Vulnerability : CVE-2026-83607
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and ...
XML Injection
Overview @xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom Affected versions of this package are vulnerable to XML Injection vi...
CVE-2026-83607
A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. This vulnerability allows a remote attacker to inject malicious content, such as attributes or elements, into serialized XML or HTML documents. This occurs because the Document.createElement function does not properl...
CVE-2026-83607
xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...
AZL-99342 CVE-2026-83607 affecting package python-tensorboard 2.16.2-6
xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...
DEBIAN-CVE-2026-83607
xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...
CVE-2026-83607
xmldom , a pure JavaScript XML DOM module, is affected by an element name injection vulnerability. Prior to @xmldom/xmldom 0.8.14 and 0.9.11 , and in xmldom 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name that XMLSerializer.serializeToString() emits verbatim....
CVE-2026-83607
xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...
CVE-2026-83607 xmldom: Element name injection via createElement() bypasses requireWellFormed
xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...
CVE-2026-83607 xmldom: Element name injection via createElement() bypasses requireWellFormed
xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...
CVE-2026-83607 xmldom: Element name injection via createElement() bypasses requireWellFormed
xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...
PT-2026-84271
Name of the Vulnerable Software and Affected Versions @xmldom/xmldom versions prior to 0.8.14 @xmldom/xmldom versions prior to 0.9.11 xmldom versions 0.6.0 and earlier Description The Document.createElementtagName function stores an unvalidated element name, which is then emitted verbatim by...
CVE-2026-44455
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the...
Cross-Site Scripting
Overview Versions of react prior to 0.14.0 are vulnerable to Cross-Site Scripting XSS. The package's createElement function fails to properly validate its input object, allowing attackers to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 0.14.0 or later...