{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3axmldomxmldom/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:xmldom:xmldom:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-83605"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@xmldom/xmldom (0.7.0 - 0.9.10)","xmldom (\u003c= 0.6.0)"],"_cs_severities":["high"],"_cs_tags":["xss","injection","vulnerability","web-application"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe @xmldom/xmldom library (CVE-2026-83605) contains an attribute injection vulnerability arising from inconsistent validation between its APIs. While the public \u003ccode\u003eDocument.createAttribute()\u003c/code\u003e method correctly validates attribute names against the XML \u003ccode\u003eQName\u003c/code\u003e production, the commonly used \u003ccode\u003eElement.setAttribute()\u003c/code\u003e method calls a private \u003ccode\u003e_createAttribute()\u003c/code\u003e helper that performs no validation.\u003c/p\u003e\n\u003cp\u003eThe vulnerability allows an attacker to inject characters - such as quotes and spaces - into the attribute name parameter of \u003ccode\u003esetAttribute()\u003c/code\u003e, effectively terminating the intended attribute and injecting new ones (e.g., \u003ccode\u003eonclick\u003c/code\u003e event handlers) into the document tree. Because the library's \u003ccode\u003eXMLSerializer\u003c/code\u003e performs no validation by default, these injected attributes are rendered verbatim in the output. If this output is subsequently parsed by a browser, it can result in Cross-Site Scripting (XSS) or the overriding of security-critical attributes like \u003ccode\u003eintegrity\u003c/code\u003e or \u003ccode\u003eContent-Security-Policy\u003c/code\u003e. This vulnerability affects versions of \u003ccode\u003e@xmldom/xmldom\u003c/code\u003e from 0.7.0 through 0.9.10, as well as the legacy \u003ccode\u003exmldom\u003c/code\u003e package (\u0026lt;= 0.6.0).\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary attribute injection when user-supplied input is reflected in attribute names. This poses a significant risk to web applications using this library to process or generate XML/HTML, as it can lead to XSS, bypass of security constraints, or unauthorized execution of JavaScript if the resulting XML is rendered as HTML in a browser context.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to \u003ccode\u003e@xmldom/xmldom\u003c/code\u003e version 0.9.11 or 0.8.14 or later to access the new validation features.\u003c/li\u003e\n\u003cli\u003eImplement the \u003ccode\u003erequireWellFormed: true\u003c/code\u003e option in all \u003ccode\u003eXMLSerializer.serializeToString()\u003c/code\u003e calls that process untrusted or partially user-controlled DOM content.\u003c/li\u003e\n\u003cli\u003ePerform an audit of the codebase to identify all locations where user-provided strings are passed as the 'name' parameter to \u003ccode\u003esetAttribute()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eValidate all attribute names against the XML \u003ccode\u003eQName\u003c/code\u003e production before calling \u003ccode\u003esetAttribute()\u003c/code\u003e if the library cannot be updated or if strict serialization cannot be enabled.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-09T03:48:50Z","date_published":"2026-09-09T03:48:50Z","id":"https://feed.craftedsignal.io/briefs/2026-09-xmldom-attribute-injection/","summary":"The @xmldom/xmldom library fails to validate attribute names during the use of Element.setAttribute, allowing attackers to inject malicious attributes into serialized XML output leading to potential XSS.","title":"Attribute Injection in @xmldom/xmldom via Element.setAttribute","url":"https://feed.craftedsignal.io/briefs/2026-09-xmldom-attribute-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:xmldom:xmldom:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}