xmldom requireWellFormed Serialization Bypass

The xmldom package is vulnerable to a security bypass affecting the requireWellFormed option in XMLSerializer. The issue stems from the use of a regular expression compiled with the m (multiline) flag to validate XML element and attribute names. Under these conditions, the $ anchor matches line terminators rather than the end of the entire string. Consequently, the validator only verifies that the first line of an element or attribute name is well-formed, allowing any content following a line terminator (U+000A, U+000D, U+2028, or U+2029) to be serialized verbatim.

This vulnerability impacts applications that rely on the requireWellFormed: true option as a defense against name-injection attacks, such as those identified in GHSA-w2rr-34g9-rvrj and GHSA-4w3w-2rp5-g8jm. Attackers capable of influencing element or attribute names during programmatic DOM construction can bypass these safety checks to inject arbitrary XML or HTML. If the resulting output is rendered in a browser, this injection can lead to Cross-Site Scripting (XSS).

Impact

The vulnerability allows for the bypass of previously implemented security mitigations for XML name injection. Successful exploitation enables the injection of arbitrary markup into serialized XML strings. When these strings are rendered in web contexts, attackers can achieve Cross-Site Scripting (XSS), potentially leading to unauthorized data access, session hijacking, or other client-side malicious activity. This affects all downstream applications that trust xmldom to sanitize output through the requireWellFormed serializer option.

Recommendation

• Upgrade the xmldom dependency to a version that patches CVE-2026-83617.
• Audit all application codebases for instances of XMLSerializer.serializeToString() that utilize the { requireWellFormed: true } option to ensure they are updated to the corrected library version.
• For applications handling untrusted user input, implement server-side validation of element and attribute names before DOM construction to ensure they strictly conform to XML QName specifications.
• Ensure that serialized output containing user-controlled data is properly escaped or sanitized before rendering it in browser-based contexts to mitigate residual XSS risks.