CVE-2026-83605 xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
Attackers can inject malicious attributes into XML output via setAttribute, leading to XSS in browser-consumed content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-83605?
CVE-2026-83605 is a high-severity cross-site scripting vulnerability in @xmldom xmldom, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private _createAttribute(name) path without validating the attribute name, while Document.createAttribute(name) validates against QName. XMLSerializer.serializeToString() emits attribute names verbatim, and requireWellFormed: true did not validate them, so a crafted name can terminate the intended attribute and inject additional attributes, including event handlers, into browser-consumed output; synthesized xmlns:PREFIX declarations expose the same unchecked-name boundary. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.
Weakness: CWE-91
Which versions are affected by CVE-2026-83605?
6 open source packages ship an affected version, including @xmldom/xmldom and xmldom.
| Package | Affected | Fixed in |
|---|---|---|
@xmldom/xmldom npm | From 0.7.0 | 0.8.14 |
@xmldom/xmldom npm | From 0.7.0 | 0.8.14 |
@xmldom/xmldom npm | From 0.9.0 | 0.9.11 |
@xmldom/xmldom npm | From 0.9.0 | 0.9.11 |
xmldom npm | All versions to 0.6.0 | None |
xmldom npm | All versions to 0.6.0 | None |
How do I fix CVE-2026-83605?
Upgrade @xmldom/xmldom to a fixed version for your release line: 0.8.14 or 0.9.11.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-83605 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-83605 exists.
Sources
Also known as AZL-99347, CLSA-2026-1790458285, DEBIAN-CVE-2026-83605, ECHO-f69a-fdb4-9b18, GHSA-4w3w-2rp5-g8jm, MINI-542c-29pm-69hv and 6 more.