XML Parser Vulnerability in xmldom JavaScript Module
CVE-2026-83609

8.7HIGH

Key Information:

Vendor

Xmldom

Status
Xmldom
Vendor
CVE Published:
1 September 2026

What is CVE-2026-83609?

The xmldom JavaScript module, versions 0.9.0 to 0.9.12, contains a vulnerability that allows the creation of malformed XML names. This occurs due to the improper validation of names in functions like createElementNS and createAttributeNS when using multiline ECMAScript line terminators. As such, an attacker can leverage this flaw to inject markup into XML documents. The issue has been resolved in version 0.9.12, which corrects the validation process in the reg() builder.

Affected Version(s)

xmldom >= 0.9.0, < 0.9.12

xmldom >= 0.9.0, < 0.9.12

References

https://github.com/xmldom/xmldom/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/xmldom/xmldom/pull/1071
x_refsource_MISC
https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.