CVE-2026-83608

A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. A remote attacker can exploit this vulnerability by providing a specially crafted DocumentType.name containing characters like or whitespace. This bypasses the requireWellFormed validation, allowing the injection of...

CVE-2026-83617 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QNameexact expression produced by reg in lib/grammar.js, which inherits the multiline...

CVE-2026-83610 xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReferencename accepts an invalid name and the ENTITYREFERENCENODE serializer...

CVE-2026-83610

xmldom , a pure JavaScript XML DOM library, is vulnerable to XML fragment injection via Document.createEntityReference(name) accepting an invalid name. When the resulting EntityReference node is serialized with XMLSerializer.serializeToString() using requireWellFormed: true, the invalid nodeName ...

CVE-2026-83608 xmldom: DocType `name` Injection Bypasses requireWellFormed

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENTTYPENODE branch in lib/dom.js validates publicId, systemId, and internalSubset under...

CVE-2026-83608

xmldom (a pure JavaScript XML DOM module) is vulnerable to a DocType name injection that bypasses the requireWellFormed strict mode. The DOCUMENT_TYPE_NODE branch in lib/dom.js validates publicId, systemId, and internalSubset but emits DocumentType.name verbatim; a name containing > or whitesp...

CVE-2026-83605

xmldom is a pure JavaScript W3C DOM Level 2 Core module. The vulnerability lies in Element.setAttribute() , which invokes the private _createAttribute(name) path without validating the attribute name against QName , unlike Document.createAttribute(). Because XMLSerializer.serializeToString() emit...