DOM Parsing Vulnerability in xmldom Product by xmldom
CVE-2026-83605
8.7HIGH
What is CVE-2026-83605?
The xmldom library, used for parsing XML in JavaScript, has a vulnerability where the Element.setAttribute() function allows for unvalidated attribute names, leading to potential attribute injection. Specifically, it calls a private method without performing all necessary validations, which could result in the injection of malicious attributes into browser-processed output. This vulnerability highlights the importance of strict validation to prevent crafted names from compromising security, especially in web applications. Fixed versions have been released, yet older versions remain vulnerable.
Affected Version(s)
xmldom <= 0.6.0
xmldom >= 0.7.0, < 0.8.14 < 0.7.0, 0.8.14
xmldom >= 0.9.0, < 0.9.11 < 0.9.0, 0.9.11