What is the CVSS score of CVE-2026-83605?

CVE-2026-83605 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2026-83605?

Yes, a public proof-of-concept exploit is available for CVE-2026-83605. Prioritise patching immediately. EPSS: 0.3%.

Xmldom CVE-2026-83605

Q: Which versions of Xmldom are affected by CVE-2026-83605?

Vulnerable versions of the xmldom JavaScript library (@xmldom/xmldom <0.8.14/0.9.11 and legacy xmldom ≤0.6.0) expose organizations to XML injection attacks enabling arbitrary code execution in…. A patch is available.

Q: How to fix or mitigate CVE-2026-83605?

Within 24 hours: Identify all applications and dependencies using xmldom, capturing version information for both @xmldom/xmldom and legacy xmldom packages. Within 7 days: Upgrade @xmldom/xmldom to version 0.8.14 or later (0.8.x line) or version 0.9.11 or later (0.9.x line); discontinue and migrate any legacy xmldom usage to patched @xmldom/xmldom versions; implement input validation on attribute names to block injection syntax. Within 30 days: Complete regression testing of upgraded services, confirm application functionality remains intact, and verify all legacy xmldom references are fully retired.

EUVD-2026-69215 HIGH

XML Injection (aka Blind XPath Injection) (CWE-91)

2026-09-01 GitHub_M

GHSA-4w3w-2rp5-g8jm

Code Injection Xmldom

8.7

CVSS 4.0 · Vendor: GitHub_M

View

Vulnerability Assessment

Weakness

CWE

CWE-91

OWASP Top 10:2025

A05:2025 - Injection

ASVS 5.0

V1 - Encoding and Sanitization XPath query parameterization

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 01, 2026

XML injection in the xmldom JavaScript library allows crafted attribute names to break out of attribute context during serialization, enabling injection of arbitrary attributes — including event handlers — into browser-consumed XML/HTML output. Applications using @xmldom/xmldom before 0.8.14 or 0.9.11, or any version of the legacy xmldom package (≤0.6.0), are affected when attacker-controlled data reaches Element.setAttribute() and the result is serialized via XMLSerializer.serializeToString(). No public exploit is identified at time of analysis, but the vulnerability class is well-understood and the injection mechanism is straightforward for any attacker who can influence attribute name input.

Affected VersionsENISA

xmldom ≤ 0.6.0

xmldom 0.9.0, < 0.9.11

xmldom 0.7.0, < 0.8.14

Affected Packages

npm @xmldom/xmldom fix: 0.8.14, 0.9.11

npm xmldom fix: 0.8.14, 0.9.11

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Xmldom gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE 7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Red Hat 8.1 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

High

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Sep 01, 2026 - 16:02 EUVD

CVE Published

Sep 01, 2026 - 14:18 cve.org

HIGH 8.7

DescriptionCVE.org

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private _createAttribute(name) path without validating the attribute name, while Document.createAttribute(name) validates against QName. XMLSerializer.serializeToString() emits attribute names verbatim, and requireWellFormed: true did not validate them, so a crafted name can terminate the intended attribute and inject additional attributes, including event handlers, into browser-consumed output; synthesized xmlns:PREFIX declarations expose the same unchecked-name boundary. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 npm packages depend on @xmldom/xmldom (4 direct, 0 indirect)
2,014 npm packages depend on xmldom (861 direct, 1,179 indirect)

Ecosystem-wide dependent count for version 0.9.0 and other introduced versions.

Technical POC Analysis

CWE-91 (XML Injection).

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Executive ViewAI

Why It Matters

Vulnerable versions of the xmldom JavaScript library (@xmldom/xmldom <0.8.14/0.9.11 and legacy xmldom ≤0.6.0) expose organizations to XML injection attacks enabling arbitrary code execution in end-user browsers. Any company using these versions in production systems risks account compromise, credential theft, and regulatory violations that could impact customer trust and financial performance.

Recommended Action

Within 24 hours: Identify all applications and dependencies using xmldom, capturing version information for both @xmldom/xmldom and legacy xmldom packages. Within 7 days: Upgrade @xmldom/xmldom to version 0.8.14 or later (0.8.x line) or version 0.9.11 or later (0.9.x line); discontinue and migrate any legacy xmldom usage to patched @xmldom/xmldom versions; implement input validation on attribute names to block injection syntax. Within 30 days: Complete regression testing of upgraded services, confirm application functionality remains intact, and verify all legacy xmldom references are fully retired.

Business Impact: High

Compensating Controls

Vendor-released patch: @xmldom/xmldom version 0.8.14+ (0.8.x line) or 0.9.11+ (0.9.x line). Legacy xmldom ≤0.6.0 has no available patch; immediate migration is required. If immediate upgrade is not feasible: enforce strict input validation on attribute names to block injection sequences; deploy Content Security Policy headers to prevent injected event handler execution; restrict untrusted data flows to Element.setAttribute() calls.

Threat Intelligence Overview

EPSS Score

0.3%

Top 72% exploitable

Threat Intel

1 sources

Exploit

POC

Public exploit code exists

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA MSRC Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

Poc

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

More in Xmldom

View all

CVE-2022-39353 CRITICAL Act Now POC

9.8 Nov 02

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. Rated crit

CVE-2026-83610 MEDIUM This Month POC

6.3 Sep 01

XML injection via EntityReference in xmldom enables attacker-controlled XML markup to escape entity-reference boundaries

CVE-2022-37616 CRITICAL Act Now

9.8 Oct 11

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) pa

CVE-2026-83615 HIGH This Week POC

8.7 Sep 01

Quadratic namespace-map allocation in xmldom's SAX parser allows unauthenticated remote attackers to exhaust the Node.js

CVE-2026-83614 HIGH This Week POC

8.7 Sep 01

Two independent quadratic-complexity denial-of-service paths in the xmldom JavaScript XML parser allow remote unauthenti

CVE-2026-83616 HIGH This Week POC

8.7 Sep 01

Processing-instruction target injection in the @xmldom/xmldom JavaScript library allows XML structure breakout through u

CVE-2026-83608 HIGH This Week POC

8.7 Sep 01

XML injection in the xmldom serializer allows a crafted DocumentType.name containing '>' or whitespace to prematurely cl

CVE-2026-83607 HIGH This Week POC

8.7 Sep 01

XML injection and cross-site scripting in the xmldom JavaScript library allows attacker-controlled tag names to be injec

CVE-2026-83613 HIGH This Week POC

8.7 Sep 01

Quadratic attribute-processing complexity in xmldom's DOMParser enables remote unauthenticated denial of service against

CVE-2026-83618 HIGH This Week POC

8.7 Sep 01

XML injection in @xmldom/xmldom versions 0.9.10 and 0.9.11 bypasses the requireWellFormed serializer's DocumentType vali

CVE-2026-83617 HIGH This Week POC

8.7 Sep 01

XML injection in @xmldom/xmldom 0.9.11 allows attackers who supply crafted element or attribute names containing ECMAScr

CVE-2026-83609 HIGH This Week POC

8.7 Sep 01

XML injection in @xmldom/xmldom 0.9.0-0.9.11 allows an attacker to embed malicious markup into serialized XML output by

Same weakness CWE-91 – XML Injection (aka Blind XPath Injection)

View all

CVE-2020-0646 CRITICAL POC

9.8

CVE-2023-46214 HIGH POC

8.8

CVE-2023-27253 HIGH POC

8.8

CVE-2013-7429 CRITICAL POC

9.8

CVE-2025-66034 CRITICAL POC

9.8

CVE-2023-43187 CRITICAL POC

9.8

CVE-2019-17626 CRITICAL POC

9.8

CVE-2019-16941 CRITICAL POC

9.8

Same technique Code Injection

View all

CVE-2023-3519 CRITICAL POC

9.8

CVE-2021-22205 CRITICAL POC

10.0

CVE-2024-23692 CRITICAL POC

9.8

CVE-2012-0158 HIGH POC

8.8

CVE-2021-44529 CRITICAL POC

9.8

CVE-2014-6287 CRITICAL POC

9.8

CVE-2017-7494 CRITICAL POC

9.8

CVE-2025-24893 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Module for Python 3 15 SP7	Not-Affected
SUSE Linux Enterprise Server 15 SP7	Not-Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-83605 ADVISORY https://vuldb.com/vuln/397678 REF https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e REF https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44 REF https://github.com/xmldom/xmldom/pull/1043 REF https://github.com/xmldom/xmldom/pull/1050 REF https://github.com/xmldom/xmldom/releases/tag/0.8.14 REF https://github.com/xmldom/xmldom/releases/tag/0.9.11 REF https://github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jm

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back