{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/xmldom--0.6.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:xmldom:xmldom:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-83605"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@xmldom/xmldom (0.7.0 - 0.9.10)","xmldom (\u003c= 0.6.0)"],"_cs_severities":["high"],"_cs_tags":["xss","injection","vulnerability","web-application"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe @xmldom/xmldom library (CVE-2026-83605) contains an attribute injection vulnerability arising from inconsistent validation between its APIs. While the public \u003ccode\u003eDocument.createAttribute()\u003c/code\u003e method correctly validates attribute names against the XML \u003ccode\u003eQName\u003c/code\u003e production, the commonly used \u003ccode\u003eElement.setAttribute()\u003c/code\u003e method calls a private \u003ccode\u003e_createAttribute()\u003c/code\u003e helper that performs no validation.\u003c/p\u003e\n\u003cp\u003eThe vulnerability allows an attacker to inject characters - such as quotes and spaces - into the attribute name parameter of \u003ccode\u003esetAttribute()\u003c/code\u003e, effectively terminating the intended attribute and injecting new ones (e.g., \u003ccode\u003eonclick\u003c/code\u003e event handlers) into the document tree. Because the library's \u003ccode\u003eXMLSerializer\u003c/code\u003e performs no validation by default, these injected attributes are rendered verbatim in the output. If this output is subsequently parsed by a browser, it can result in Cross-Site Scripting (XSS) or the overriding of security-critical attributes like \u003ccode\u003eintegrity\u003c/code\u003e or \u003ccode\u003eContent-Security-Policy\u003c/code\u003e. This vulnerability affects versions of \u003ccode\u003e@xmldom/xmldom\u003c/code\u003e from 0.7.0 through 0.9.10, as well as the legacy \u003ccode\u003exmldom\u003c/code\u003e package (\u0026lt;= 0.6.0).\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary attribute injection when user-supplied input is reflected in attribute names. This poses a significant risk to web applications using this library to process or generate XML/HTML, as it can lead to XSS, bypass of security constraints, or unauthorized execution of JavaScript if the resulting XML is rendered as HTML in a browser context.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to \u003ccode\u003e@xmldom/xmldom\u003c/code\u003e version 0.9.11 or 0.8.14 or later to access the new validation features.\u003c/li\u003e\n\u003cli\u003eImplement the \u003ccode\u003erequireWellFormed: true\u003c/code\u003e option in all \u003ccode\u003eXMLSerializer.serializeToString()\u003c/code\u003e calls that process untrusted or partially user-controlled DOM content.\u003c/li\u003e\n\u003cli\u003ePerform an audit of the codebase to identify all locations where user-provided strings are passed as the 'name' parameter to \u003ccode\u003esetAttribute()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eValidate all attribute names against the XML \u003ccode\u003eQName\u003c/code\u003e production before calling \u003ccode\u003esetAttribute()\u003c/code\u003e if the library cannot be updated or if strict serialization cannot be enabled.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-09T03:48:50Z","date_published":"2026-09-09T03:48:50Z","id":"https://feed.craftedsignal.io/briefs/2026-09-xmldom-attribute-injection/","summary":"The @xmldom/xmldom library fails to validate attribute names during the use of Element.setAttribute, allowing attackers to inject malicious attributes into serialized XML output leading to potential XSS.","title":"Attribute Injection in @xmldom/xmldom via Element.setAttribute","url":"https://feed.craftedsignal.io/briefs/2026-09-xmldom-attribute-injection/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:xmldom_project:xmldom:0.9.11:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-83617"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["xmldom (0.9.11)","xmldom (0.9.0 - 0.9.11)","xmldom (\u003c= 0.6.0)","@xmldom/xmldom (0.7.0-0.8.14, 0.9.0-0.9.11)"],"_cs_severities":["high"],"_cs_tags":["injection","xss","library-vulnerability"],"_cs_type":"advisory","_cs_vendors":["xmldom"],"content_html":"\u003cp\u003eThe xmldom package is vulnerable to a security bypass affecting the \u003ccode\u003erequireWellFormed\u003c/code\u003e option in \u003ccode\u003eXMLSerializer\u003c/code\u003e. The issue stems from the use of a regular expression compiled with the \u003ccode\u003em\u003c/code\u003e (multiline) flag to validate XML element and attribute names. Under these conditions, the \u003ccode\u003e$\u003c/code\u003e anchor matches line terminators rather than the end of the entire string. Consequently, the validator only verifies that the first line of an element or attribute name is well-formed, allowing any content following a line terminator (U+000A, U+000D, U+2028, or U+2029) to be serialized verbatim.\u003c/p\u003e\n\u003cp\u003eThis vulnerability impacts applications that rely on the \u003ccode\u003erequireWellFormed: true\u003c/code\u003e option as a defense against name-injection attacks, such as those identified in GHSA-w2rr-34g9-rvrj and GHSA-4w3w-2rp5-g8jm. Attackers capable of influencing element or attribute names during programmatic DOM construction can bypass these safety checks to inject arbitrary XML or HTML. If the resulting output is rendered in a browser, this injection can lead to Cross-Site Scripting (XSS).\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for the bypass of previously implemented security mitigations for XML name injection. Successful exploitation enables the injection of arbitrary markup into serialized XML strings. When these strings are rendered in web contexts, attackers can achieve Cross-Site Scripting (XSS), potentially leading to unauthorized data access, session hijacking, or other client-side malicious activity. This affects all downstream applications that trust \u003ccode\u003exmldom\u003c/code\u003e to sanitize output through the \u003ccode\u003erequireWellFormed\u003c/code\u003e serializer option.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003exmldom\u003c/code\u003e dependency to a version that patches CVE-2026-83617.\u003c/li\u003e\n\u003cli\u003eAudit all application codebases for instances of \u003ccode\u003eXMLSerializer.serializeToString()\u003c/code\u003e that utilize the \u003ccode\u003e{ requireWellFormed: true }\u003c/code\u003e option to ensure they are updated to the corrected library version.\u003c/li\u003e\n\u003cli\u003eFor applications handling untrusted user input, implement server-side validation of element and attribute names before DOM construction to ensure they strictly conform to XML QName specifications.\u003c/li\u003e\n\u003cli\u003eEnsure that serialized output containing user-controlled data is properly escaped or sanitized before rendering it in browser-based contexts to mitigate residual XSS risks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-08T21:52:48Z","date_published":"2026-09-08T21:50:46Z","id":"https://feed.craftedsignal.io/briefs/2026-09-xmldom-injection-bypass/","summary":"The xmldom serializer fails to properly validate element and attribute names when the requireWellFormed option is enabled, allowing attackers to inject arbitrary markup via line-terminated strings.","title":"xmldom requireWellFormed Serialization Bypass","url":"https://feed.craftedsignal.io/briefs/2026-09-xmldom-injection-bypass/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:xmldom:xmldom:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"id":"CVE-2026-83616"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@xmldom/xmldom (\u003c= 0.8.14)","@xmldom/xmldom (0.9.0 - 0.9.11)","xmldom (\u003c= 0.6.0)"],"_cs_severities":["high"],"_cs_tags":["injection","xss","xxe","vulnerability"],"_cs_type":"advisory","_cs_vendors":["xmldom"],"content_html":"\u003cp\u003eThe @xmldom/xmldom library is susceptible to an XML injection vulnerability (CVE-2026-83616) due to insufficient validation of the target parameter in the \u003ccode\u003eDocument.createProcessingInstruction()\u003c/code\u003e method. When developers use the \u003ccode\u003erequireWellFormed: true\u003c/code\u003e option in \u003ccode\u003eXMLSerializer.serializeToString()\u003c/code\u003e, the library fails to properly sanitize the processing instruction (PI) target. Specifically, it does not check for the \u003ccode\u003e\u0026gt;\u003c/code\u003e character, which prematurely terminates the processing instruction (\u003ccode\u003e\u0026lt;?target data?\u0026gt;\u003c/code\u003e).\u003c/p\u003e\n\u003cp\u003eAn attacker controlling the input to the target parameter can inject arbitrary XML elements, including \u003ccode\u003e\u0026lt;script\u0026gt;\u003c/code\u003e tags, into the serialized output. If this output is subsequently served as XHTML or processed by a downstream XML parser, it may lead to Cross-Site Scripting (XSS) or XML External Entity (XXE) injection attacks. The protection is not enabled by default, requiring developers to explicitly opt-in to the \u003ccode\u003erequireWellFormed\u003c/code\u003e mode, which remains incomplete in its validation logic across various versions of the library.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the injection of arbitrary XML structure, leading to potential XSS in browser-based applications and XXE vulnerabilities in backend XML parsers. Impact is localized to applications that generate XML dynamically using user-provided data without sufficient secondary validation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to a non-vulnerable version of @xmldom/xmldom as soon as updates are available.\u003c/li\u003e\n\u003cli\u003eAudit all \u003ccode\u003eserializeToString()\u003c/code\u003e call sites to ensure \u003ccode\u003erequireWellFormed: true\u003c/code\u003e is explicitly enabled for any serialization of untrusted or user-influenced DOM content.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation on any string used as a processing instruction target, ensuring it conforms strictly to the XML \u003ccode\u003eNCName\u003c/code\u003e production (no colons, whitespace, or XML-reserved characters like \u003ccode\u003e\u0026gt;\u003c/code\u003e or \u003ccode\u003e?\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eDo not rely on \u003ccode\u003erequireWellFormed: true\u003c/code\u003e as the sole mitigation for untrusted input, as it is an opt-in configuration that may not catch all malicious injection vectors.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-08T21:50:39Z","date_published":"2026-09-08T21:50:39Z","id":"https://feed.craftedsignal.io/briefs/2026-09-xmldom-injection/","summary":"The @xmldom/xmldom library fails to validate the target parameter in createProcessingInstruction, enabling attackers to break out of XML processing instructions and inject arbitrary content when serializing with the requireWellFormed flag.","title":"XML Injection Vulnerability in @xmldom/xmldom via Processing Instruction Targets","url":"https://feed.craftedsignal.io/briefs/2026-09-xmldom-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Xmldom (\u003c= 0.6.0)","version":"https://jsonfeed.org/version/1.1"}