XML DOMParser and XMLSerializer Module Vulnerability in xmldom
CVE-2026-83617

8.7HIGH

Key Information:

Vendor

Xmldom

Status
Xmldom
Vendor
CVE Published:
1 September 2026

What is CVE-2026-83617?

A vulnerability in the xmldom JavaScript library enables bypassing strict serialization checks for XML elements and attributes. Specifically, the issue arises when the 'requireWellFormed: true' settings allow certain newline characters to be included in valid names, potentially leading to injection of unwanted markup. This flaw can compromise the integrity of XML documents processed by the library. The vulnerability has been resolved in version 0.9.12. Users are strongly encouraged to upgrade to mitigate this risk.

Affected Version(s)

xmldom >= 0.9.11, < 0.9.12

xmldom >= 0.9.11, < 0.9.12

References

https://github.com/xmldom/xmldom/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/xmldom/xmldom/pull/1071
x_refsource_MISC
https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.