Cross-Site Scripting Vulnerability in xmldom by xmldom
CVE-2026-83607
8.7HIGH
What is CVE-2026-83607?
The xmldom library contains a vulnerability where the function Document.createElement(tagName) fails to validate element names, allowing attacker-controlled inputs during XML serialization. This permissive validation leads to potential injection of harmful attributes, elements, or processing instructions, which can be exploited for cross-site scripting (XSS) when the resulting content is consumed by a browser. This vulnerability impacts versions before @xmldom/xmldom 0.8.14 and 0.9.11, as well as xmldom version 0.6.0 and earlier.
Affected Version(s)
xmldom <= 0.6.0
xmldom >= 0.7.0, < 0.8.14 < 0.7.0, 0.8.14
xmldom >= 0.9.0, < 0.9.11 < 0.9.0, 0.9.11