Skip to main content

xmldom CVE-2026-83611

| EUVDEUVD-2026-69225 MEDIUM
Improper Validation of Syntactic Correctness of Input (CWE-1286)
2026-09-01 GitHub_M
Authentication Bypass Xmldom Red Hat Suse
6.9
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-reachable via any parseFromString call, no auth required, low integrity impact from silent gate bypass, no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
5.3 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Sep 01, 2026 - 16:02 EUVD
Source Code Evidence Fetched
Sep 01, 2026 - 15:16 vuln.today
Analysis Generated
Sep 01, 2026 - 15:16 vuln.today
CVE Published
Sep 01, 2026 - 14:34 cve.org
MEDIUM 6.9

DescriptionCVE.org

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString() can silently accept an end tag such as </a\njunk>, close the element, and discard the trailing content. On 0.9.x, the lib/sax.js end-tag validator inherits the multiline flag from reg(), allowing the first line to satisfy the anchored XML ETag production; older lines have no equivalent residue validation. This parser differential can bypass a parse-before-trust well-formedness gate, although it does not inject the discarded content; onError on 0.9.x and errorHandler on 0.8.x are the relevant reporting interfaces. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

AnalysisAI

Silent acceptance of malformed XML end tags in xmldom's DOMParser allows crafted input to bypass parse-before-trust well-formedness gates in security-sensitive Node.js applications. The flaw affects @xmldom/xmldom prior to 0.8.15 and 0.9.12, as well as all versions of the legacy xmldom package (0.6.0 and earlier), for which no patch exists. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application calls DOMParser.parseFromString() on attacker-controlled XML using an unpatched @xmldom/xmldom version (prior to 0.8.15 or 0.9.12) or any version of the legacy xmldom package, AND that the application uses parse success - absence of thrown errors or error callbacks - as a security gate for XML well-formedness. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.9 with VI:L accurately reflects the bounded integrity impact: the vulnerability enables bypass of a well-formedness gate but does not inject content or grant code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade @xmldom/xmldom to version 0.8.15 (0.8.x track) or 0.9.12 (0.9.x track), which enforce strict XML ETag well-formedness and report malformed end tags via the onError callback (0.9.x) or errorHandler interface (0.8.x) instead of silently discarding trailing content; release artifacts are at https://github.com/xmldom/xmldom/releases/tag/0.8.15 and https://github.com/xmldom/xmldom/releases/tag/0.9.12. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Xmldom

View all
CVE-2022-39353 CRITICAL POC
9.8 Nov 02

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. Rated crit
CVE-2026-83610 MEDIUM POC
6.3 Sep 01

XML injection via EntityReference in xmldom enables attacker-controlled XML markup to escape entity-reference boundaries
CVE-2022-37616 CRITICAL
9.8 Oct 11

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) pa
CVE-2026-83615 HIGH
8.7 Sep 01

Quadratic namespace-map allocation in xmldom's SAX parser allows unauthenticated remote attackers to exhaust the Node.js
CVE-2026-83608 HIGH
8.7 Sep 01

XML injection in the xmldom serializer allows a crafted DocumentType.name containing '>' or whitespace to prematurely cl
CVE-2026-83605 HIGH
8.7 Sep 01

XML injection in the xmldom JavaScript library allows crafted attribute names to break out of attribute context during s
CVE-2026-83613 HIGH
8.7 Sep 01

Quadratic attribute-processing complexity in xmldom's DOMParser enables remote unauthenticated denial of service against
CVE-2026-83618 HIGH
8.7 Sep 01

XML injection in @xmldom/xmldom versions 0.9.10 and 0.9.11 bypasses the requireWellFormed serializer's DocumentType vali
CVE-2026-83619 HIGH
8.7 Sep 01

ReDoS in @xmldom/xmldom versions 0.7.0 through 0.8.14 allows remote unauthenticated attackers to stall the Node.js event
CVE-2026-83617 HIGH
8.7 Sep 01

XML injection in @xmldom/xmldom 0.9.11 allows attackers who supply crafted element or attribute names containing ECMAScr
CVE-2026-83616 HIGH
8.7 Sep 01

Processing-instruction target injection in the @xmldom/xmldom JavaScript library allows XML structure breakout through u
CVE-2026-83614 HIGH
8.7 Sep 01

Two independent quadratic-complexity denial-of-service paths in the xmldom JavaScript XML parser allow remote unauthenti

Same weakness CWE-1286 – Improper Validation of Syntactic Correctness of Input

View all
CVE-2024-6284 MEDIUM POC
6.3
CVE-2025-10954 MEDIUM POC
5.5
CVE-2024-6763 MEDIUM POC
5.3
CVE-2021-31988 HIGH
8.8
CVE-2026-57026 HIGH
8.7
CVE-2026-33778 HIGH
8.7
CVE-2025-8873 HIGH
8.7
CVE-2024-39542 HIGH
8.7

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected

Share

CVE-2026-83611 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy