Description
An embedded line terminator bypasses xmldom’s always-on, WHATWG-mandated creation-time name validation. createElementNS, createAttributeNS, createDocumentType, and createAttribute should reject a malformed qualified name with InvalidCharacterError, but a name whose first line is well-formed slips through and enters the DOM.
Recommendation
Update the @xmldom/xmldom package to the latest compatible version. Followings are version details:
- Affected version(s): >= 0.9.0, <= 0.9.11
- Patched version(s): 0.9.12
References
Could your website be exposed too?
SmartScanner can check your website for xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the and gives you actionable findings to investigate.
Start a free scanRelated Issues
- xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator - CVE-2026-83617
- xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator - CVE-2026-83618
- xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization - CVE-2026-83610
- xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed - CVE-2026-83605
You might also like:
See something that needs correcting? Let us knowUpdated September 08, 2026