CVE-2026-83617 in xmldom
Summary
by MITRE • 09/01/2026
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QName_exact expression produced by reg() in lib/grammar.js, which inherits the multiline flag. A name with a valid first line followed by U+000A, U+000D, U+2028, or U+2029 and breakout markup therefore passes validation and is emitted verbatim in element start and end tags or attribute names. This bypasses the strict-serialization checks introduced for the earlier element-name and attribute-name injection advisories, while the default serialization path remains outside the strict guarantee. This issue is fixed in @xmldom/xmldom version 0.9.12.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified within the xmldom library stems from a flaw in its XML parsing and validation logic, specifically affecting versions ranging from 0.9.11 to 0.9.12. This open-source JavaScript module implements W3C standard-based DOMParser and XMLSerializer functionalities for processing XML documents. The core issue resides in the regular expression engine used to validate Qualified Names (QNames) for elements and attributes when the requireWellFormed option is enabled. During this validation process, the library utilizes a regex pattern generated by the reg() function located in lib/grammar.js. This specific implementation inadvertently inherits the multiline flag from its parent context or construction method. The presence of this flag alters how anchor characters within regular expressions behave, fundamentally changing the boundary conditions for string matching and allowing malformed input to bypass strict validation checks that were previously implemented to prevent injection attacks.
Technically, the flaw allows an attacker to inject malicious content by exploiting Unicode line separator characters such as U+000A (Line Feed), U+000D (Carriage Return), U+2028 (Line Separator), and U+2029 (Paragraph Separator). When a name string contains a valid first line followed immediately by one of these specific newline or break-out characters, the anchored QName_exact expression fails to reject it as invalid. Instead, the parser accepts this malformed structure as well-formed XML. Consequently, the library emits this input verbatim within element start and end tags or attribute names without sanitization. This behavior effectively bypasses strict serialization checks that were introduced in earlier advisories to mitigate element-name and attribute-name injection vulnerabilities. The default serialization path remains outside these strict guarantees, meaning that even if some validation occurs during parsing, the output generation process does not enforce sufficient constraints on characters that could disrupt XML structure or enable further exploitation vectors such as Cross-Site Scripting (XSS) in web contexts where this library is used for data processing.
The operational impact of this vulnerability is significant for applications relying on xmldom to parse untrusted XML input, particularly those involved in server-side rendering, API response handling, or document generation. An attacker could craft a specially constructed XML payload containing these specific Unicode line breaks within element names or attribute identifiers. Upon parsing and subsequent serialization by the vulnerable library version, this malicious structure is preserved and output directly into the resulting HTML or XML stream. In web applications that serialize parsed data back to clients, this can lead to broken markup structures, potential denial of service due to malformed document trees, or more severe injection attacks if the context allows for script execution. The bypass of strict serialization checks means that previous mitigations are rendered ineffective, leaving systems exposed until an upgrade is performed.
To mitigate this risk, organizations must immediately update their dependencies to @xmldom/xmldom version 0.9.12 or later, where this validation logic has been corrected to properly reject names containing these breakout characters even when the multiline flag is active. For environments unable to patch immediately, input sanitization should be implemented at the application layer to strip or escape Unicode line separators and other control characters from XML element names and attribute identifiers before they are passed to the parser. Additionally, developers should ensure that any custom serialization logic adheres strictly to W3C standards for QName formatting, avoiding reliance solely on library defaults when handling untrusted data. This vulnerability is categorized under CWE-20: Improper Input Validation, as it involves a failure to correctly validate input against expected formats and constraints. In the context of the MITRE ATT&CK framework, this flaw facilitates techniques related to Injection (T1190), specifically allowing for XML injection which can be leveraged in subsequent attack chains such as Server-Side Request Forgery or Cross-Site Scripting depending on the application architecture.