Description
Element.setAttribute() in @xmldom/xmldom bypasses attribute name validation by calling the private _createAttribute(name) method, which performs no validation. The public createAttribute() method correctly validates names against an anchored QName pattern, but setAttribute() never uses it.
Recommendation
Update the @xmldom/xmldom package to the latest compatible version. Followings are version details:
Affected version(s): **>= 0.7.0, <= 0.8.13 >= 0.9.0, <= 0.9.10** Patched version(s): **0.8.14 0.9.11**
References
Could your website be exposed too?
SmartScanner can check your website for xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed and gives you actionable findings to investigate.
Start a free scanRelated Issues
- xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed - xmldom - CVE-2026-83605
- xmldom: Element name injection via createElement() bypasses requireWellFormed - CVE-2026-83607
- xmldom: DocType `name` Injection Bypasses requireWellFormed - CVE-2026-83608
- xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator - CVE-2026-83617
You might also like:
See something that needs correcting? Let us knowUpdated September 08, 2026