Description
Document.createElement() in @xmldom/xmldom accepts arbitrary strings as the tagName parameter with zero validation. The serializer emits the tag name verbatim into XML/HTML output.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 0.6.0
References
Could your website be exposed too?
SmartScanner can check your website for xmldom: Element name injection via createElement() bypasses requireWellFormed - xmldom and gives you actionable findings to investigate.
Start a free scanRelated Issues
- xmldom: Element name injection via createElement() bypasses requireWellFormed - CVE-2026-83607
- xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed - CVE-2026-83605
- xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed - xmldom - CVE-2026-83605
- xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator - CVE-2026-83617
You might also like:
See something that needs correcting? Let us knowUpdated September 08, 2026