Xmldom (<= 0.6.0) - CraftedSignal Threat Feed

Attribute Injection in @xmldom/xmldom via Element.setAttribute

hello@craftedsignal.io — Wed, 09 Sep 2026 03:48:50 +0000

The @xmldom/xmldom library (CVE-2026-83605) contains an attribute injection vulnerability arising from inconsistent validation between its APIs. While the public Document.createAttribute() method correctly validates attribute names against the XML QName production, the commonly used Element.setAttribute() method calls a private _createAttribute() helper that performs no validation.

The vulnerability allows an attacker to inject characters - such as quotes and spaces - into the attribute name parameter of setAttribute(), effectively terminating the intended attribute and injecting new ones (e.g., onclick event handlers) into the document tree. Because the library's XMLSerializer performs no validation by default, these injected attributes are rendered verbatim in the output. If this output is subsequently parsed by a browser, it can result in Cross-Site Scripting (XSS) or the overriding of security-critical attributes like integrity or Content-Security-Policy. This vulnerability affects versions of @xmldom/xmldom from 0.7.0 through 0.9.10, as well as the legacy xmldom package (<= 0.6.0).

Impact

Successful exploitation allows for arbitrary attribute injection when user-supplied input is reflected in attribute names. This poses a significant risk to web applications using this library to process or generate XML/HTML, as it can lead to XSS, bypass of security constraints, or unauthorized execution of JavaScript if the resulting XML is rendered as HTML in a browser context.

Recommendation

Upgrade to @xmldom/xmldom version 0.9.11 or 0.8.14 or later to access the new validation features.
Implement the requireWellFormed: true option in all XMLSerializer.serializeToString() calls that process untrusted or partially user-controlled DOM content.
Perform an audit of the codebase to identify all locations where user-provided strings are passed as the 'name' parameter to setAttribute().
Validate all attribute names against the XML QName production before calling setAttribute() if the library cannot be updated or if strict serialization cannot be enabled.

xmldom requireWellFormed Serialization Bypass

hello@craftedsignal.io — Tue, 08 Sep 2026 21:50:46 +0000

The xmldom package is vulnerable to a security bypass affecting the requireWellFormed option in XMLSerializer. The issue stems from the use of a regular expression compiled with the m (multiline) flag to validate XML element and attribute names. Under these conditions, the $ anchor matches line terminators rather than the end of the entire string. Consequently, the validator only verifies that the first line of an element or attribute name is well-formed, allowing any content following a line terminator (U+000A, U+000D, U+2028, or U+2029) to be serialized verbatim.

This vulnerability impacts applications that rely on the requireWellFormed: true option as a defense against name-injection attacks, such as those identified in GHSA-w2rr-34g9-rvrj and GHSA-4w3w-2rp5-g8jm. Attackers capable of influencing element or attribute names during programmatic DOM construction can bypass these safety checks to inject arbitrary XML or HTML. If the resulting output is rendered in a browser, this injection can lead to Cross-Site Scripting (XSS).

Impact

The vulnerability allows for the bypass of previously implemented security mitigations for XML name injection. Successful exploitation enables the injection of arbitrary markup into serialized XML strings. When these strings are rendered in web contexts, attackers can achieve Cross-Site Scripting (XSS), potentially leading to unauthorized data access, session hijacking, or other client-side malicious activity. This affects all downstream applications that trust xmldom to sanitize output through the requireWellFormed serializer option.

Recommendation

Upgrade the xmldom dependency to a version that patches CVE-2026-83617.
Audit all application codebases for instances of XMLSerializer.serializeToString() that utilize the { requireWellFormed: true } option to ensure they are updated to the corrected library version.
For applications handling untrusted user input, implement server-side validation of element and attribute names before DOM construction to ensure they strictly conform to XML QName specifications.
Ensure that serialized output containing user-controlled data is properly escaped or sanitized before rendering it in browser-based contexts to mitigate residual XSS risks.

XML Injection Vulnerability in @xmldom/xmldom via Processing Instruction Targets

hello@craftedsignal.io — Tue, 08 Sep 2026 21:50:39 +0000

The @xmldom/xmldom library is susceptible to an XML injection vulnerability (CVE-2026-83616) due to insufficient validation of the target parameter in the Document.createProcessingInstruction() method. When developers use the requireWellFormed: true option in XMLSerializer.serializeToString(), the library fails to properly sanitize the processing instruction (PI) target. Specifically, it does not check for the > character, which prematurely terminates the processing instruction ().

An attacker controlling the input to the target parameter can inject arbitrary XML elements, including