Skip to main content

xmldom CVE-2026-83607

| EUVDEUVD-2026-69217 HIGH
XML Injection (aka Blind XPath Injection) (CWE-91)
2026-09-01 GitHub_M
XSS Xmldom Red Hat Suse
8.7
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.7 MEDIUM

AC:H for required application preconditions (attacker input reaching createElement and output browser-rendered); UI:R and S:C for classic XSS; C:L/I:L for DOM injection impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
7.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Red Hat
8.1 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Sep 01, 2026 - 16:02 EUVD
Source Code Evidence Fetched
Sep 01, 2026 - 15:09 vuln.today
Analysis Generated
Sep 01, 2026 - 15:09 vuln.today
CVE Published
Sep 01, 2026 - 14:23 cve.org
HIGH 8.7

DescriptionCVE.org

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-controlled tag names could inject attributes, elements, or processing instructions into serialized XML or HTML and could cause cross-site scripting when browser-consumed. The unchecked values violate the XML QName constraint, and default serialization and creation-time createElement() behavior remain permissive. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.

AnalysisAI

XML injection and cross-site scripting in the xmldom JavaScript library allows attacker-controlled tag names to be injected verbatim into serialized XML or HTML output. Applications using @xmldom/xmldom prior to 0.8.14 or 0.9.11, or the legacy xmldom package at any version, are affected when they pass externally-supplied strings to Document.createElement() and then serialize the resulting DOM with XMLSerializer.serializeToString(). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three concurrent application-level conditions: (1) attacker-controlled input must be passed as the tagName argument to Document.createElement() without prior validation against the XML QName production; (2) the resulting DOM node must be serialized via XMLSerializer.serializeToString() - either with the default options or with requireWellFormed: true on an unpatched version, since the validation was missing in both paths; and (3) the serialized XML or HTML output must be delivered to and rendered by a web browser. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects the library's raw API surface - no authentication or user interaction is required to call createElement with a malicious string. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation For projects using @xmldom/xmldom, upgrade to version 0.8.14 (release tag confirmed at https://github.com/xmldom/xmldom/releases/tag/0.8.14) or 0.9.11 (https://github.com/xmldom/xmldom/releases/tag/0.9.11). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, conduct a complete inventory of all @xmldom/xmldom and legacy xmldom package usage across development and production environments using Software Composition Analysis tools. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Xmldom

View all
CVE-2022-39353 CRITICAL POC
9.8 Nov 02

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. Rated crit
CVE-2026-83610 MEDIUM POC
6.3 Sep 01

XML injection via EntityReference in xmldom enables attacker-controlled XML markup to escape entity-reference boundaries
CVE-2022-37616 CRITICAL
9.8 Oct 11

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) pa
CVE-2026-83615 HIGH
8.7 Sep 01

Quadratic namespace-map allocation in xmldom's SAX parser allows unauthenticated remote attackers to exhaust the Node.js
CVE-2026-83608 HIGH
8.7 Sep 01

XML injection in the xmldom serializer allows a crafted DocumentType.name containing '>' or whitespace to prematurely cl
CVE-2026-83605 HIGH
8.7 Sep 01

XML injection in the xmldom JavaScript library allows crafted attribute names to break out of attribute context during s
CVE-2026-83613 HIGH
8.7 Sep 01

Quadratic attribute-processing complexity in xmldom's DOMParser enables remote unauthenticated denial of service against
CVE-2026-83618 HIGH
8.7 Sep 01

XML injection in @xmldom/xmldom versions 0.9.10 and 0.9.11 bypasses the requireWellFormed serializer's DocumentType vali
CVE-2026-83619 HIGH
8.7 Sep 01

ReDoS in @xmldom/xmldom versions 0.7.0 through 0.8.14 allows remote unauthenticated attackers to stall the Node.js event
CVE-2026-83617 HIGH
8.7 Sep 01

XML injection in @xmldom/xmldom 0.9.11 allows attackers who supply crafted element or attribute names containing ECMAScr
CVE-2026-83616 HIGH
8.7 Sep 01

Processing-instruction target injection in the @xmldom/xmldom JavaScript library allows XML structure breakout through u
CVE-2026-83614 HIGH
8.7 Sep 01

Two independent quadratic-complexity denial-of-service paths in the xmldom JavaScript XML parser allow remote unauthenti

Same weakness CWE-91 – XML Injection (aka Blind XPath Injection)

View all
CVE-2020-0646 CRITICAL POC
9.8
CVE-2023-46214 HIGH POC
8.8
CVE-2023-27253 HIGH POC
8.8
CVE-2013-7429 CRITICAL POC
9.8
CVE-2023-43187 CRITICAL POC
9.8
CVE-2019-17626 CRITICAL POC
9.8
CVE-2019-16941 CRITICAL POC
9.8
CVE-2019-14277 CRITICAL POC
9.8

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected

Share

CVE-2026-83607 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy