{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/xmldom-0.9.0---0.9.11/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:xmldom_project:xmldom:0.9.11:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-83617"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["xmldom (0.9.11)","xmldom (0.9.0 - 0.9.11)","xmldom (\u003c= 0.6.0)","@xmldom/xmldom (0.7.0-0.8.14, 0.9.0-0.9.11)"],"_cs_severities":["high"],"_cs_tags":["injection","xss","library-vulnerability"],"_cs_type":"advisory","_cs_vendors":["xmldom"],"content_html":"\u003cp\u003eThe xmldom package is vulnerable to a security bypass affecting the \u003ccode\u003erequireWellFormed\u003c/code\u003e option in \u003ccode\u003eXMLSerializer\u003c/code\u003e. The issue stems from the use of a regular expression compiled with the \u003ccode\u003em\u003c/code\u003e (multiline) flag to validate XML element and attribute names. Under these conditions, the \u003ccode\u003e$\u003c/code\u003e anchor matches line terminators rather than the end of the entire string. Consequently, the validator only verifies that the first line of an element or attribute name is well-formed, allowing any content following a line terminator (U+000A, U+000D, U+2028, or U+2029) to be serialized verbatim.\u003c/p\u003e\n\u003cp\u003eThis vulnerability impacts applications that rely on the \u003ccode\u003erequireWellFormed: true\u003c/code\u003e option as a defense against name-injection attacks, such as those identified in GHSA-w2rr-34g9-rvrj and GHSA-4w3w-2rp5-g8jm. Attackers capable of influencing element or attribute names during programmatic DOM construction can bypass these safety checks to inject arbitrary XML or HTML. If the resulting output is rendered in a browser, this injection can lead to Cross-Site Scripting (XSS).\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for the bypass of previously implemented security mitigations for XML name injection. Successful exploitation enables the injection of arbitrary markup into serialized XML strings. When these strings are rendered in web contexts, attackers can achieve Cross-Site Scripting (XSS), potentially leading to unauthorized data access, session hijacking, or other client-side malicious activity. This affects all downstream applications that trust \u003ccode\u003exmldom\u003c/code\u003e to sanitize output through the \u003ccode\u003erequireWellFormed\u003c/code\u003e serializer option.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003exmldom\u003c/code\u003e dependency to a version that patches CVE-2026-83617.\u003c/li\u003e\n\u003cli\u003eAudit all application codebases for instances of \u003ccode\u003eXMLSerializer.serializeToString()\u003c/code\u003e that utilize the \u003ccode\u003e{ requireWellFormed: true }\u003c/code\u003e option to ensure they are updated to the corrected library version.\u003c/li\u003e\n\u003cli\u003eFor applications handling untrusted user input, implement server-side validation of element and attribute names before DOM construction to ensure they strictly conform to XML QName specifications.\u003c/li\u003e\n\u003cli\u003eEnsure that serialized output containing user-controlled data is properly escaped or sanitized before rendering it in browser-based contexts to mitigate residual XSS risks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-08T21:52:48Z","date_published":"2026-09-08T21:50:46Z","id":"https://feed.craftedsignal.io/briefs/2026-09-xmldom-injection-bypass/","summary":"The xmldom serializer fails to properly validate element and attribute names when the requireWellFormed option is enabled, allowing attackers to inject arbitrary markup via line-terminated strings.","title":"xmldom requireWellFormed Serialization Bypass","url":"https://feed.craftedsignal.io/briefs/2026-09-xmldom-injection-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Xmldom (0.9.0 - 0.9.11)","version":"https://jsonfeed.org/version/1.1"}