CVE-2026-83607highCWE-91

CVE-2026-83607: high-severity vulnerability in @xmldom xmldom

xmldom: Element name injection via createElement() bypasses requireWellFormed

Published

Follow this CVE+ Monitor xmldom+ Monitor node-xmldom

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.6%
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-controlled tag names could inject attributes, elements, or processing instructions into serialized XML or HTML and could cause cross-site scripting when browser-consumed. The unchecked values violate the XML QName constraint, and default serialization and creation-time createElement() behavior remain permissive. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
@xmldom · xmldomxmldom · xmldom
Related CVEs — @xmldom xmldom

In the same product, most dangerous first.

CVE-2022-39353CRITICALxmldom allows multiple root nodes in a DOMEPSS 1.6%CVE-2021-32796MEDIUMMisinterpretation of malicious XML input in xmldomEPSS 1.4%CVE-2021-21366MEDIUMMisinterpretation of malicious XML inputEPSS 1.3%CVE-2026-41673HIGHxmldom: Denial of service via uncontrolled recursion in XML serializationEPSS 0.6%CVE-2026-83611MEDIUMxmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing contentEPSS 0.6%CVE-2026-83616HIGHxmldom: Processing Instruction Target Injection Bypasses requireWellFormedEPSS 0.6%