CVE-2026-83607: xmldom: Element name injection via createElement() bypasses requireWellFormed
Document.createElement() in @xmldom/xmldom accepts arbitrary strings as the tagName parameter with zero validation. The serializer emits the tag name verbatim into XML/HTML output. Critically, the requireWellFormed: true serializer option — the recommended mitigation from CVE-2026-41672, CVE-2026-41674, and CVE-2026-34601 — did NOT catch this, making it a bypass of the existing security controls.
An attacker who controls the element name string can inject arbitrary attributes (including event handlers) into the serialized output, leading to XSS when the output is consumed by a browser or downstream parser.
References
- github.com/advisories/GHSA-w2rr-34g9-rvrj
- github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e
- github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44
- github.com/xmldom/xmldom/pull/1043
- github.com/xmldom/xmldom/pull/1050
- github.com/xmldom/xmldom/releases/tag/0.8.14
- github.com/xmldom/xmldom/releases/tag/0.9.11
- github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj
- nvd.nist.gov/vuln/detail/CVE-2026-83607
Code Behaviors & Features
Detect and mitigate CVE-2026-83607 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →