CVE-2026-83607: xmldom: Element name injection via createElement() bypasses requireWellFormed
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-controlled tag names could inject attributes, elements, or processing instructions into serialized XML or HTML and could cause cross-site scripting when browser-consumed. The unchecked values violate the XML QName constraint, and default serialization and creation-time createElement() behavior remain permissive. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.8.14 - Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.9.11
Event History
Frequently Asked Questions
Which applications are most exposed to this issue?
Applications that pass attacker-controlled strings to Document.createElement() and later serialize the resulting DOM are exposed. Risk is highest when the serialized XML or HTML is consumed by a browser, where injected markup can lead to cross-site scripting.
Is the default behavior affected?
Yes. Element creation and default serialization remain permissive, and requireWellFormed: true did not validate the element qualified name or synthesized namespace declaration.
What attacker-controlled input is needed to exploit this?
An attacker needs control over a tagName passed to Document.createElement(). A malformed name can then be emitted verbatim by XMLSerializer.serializeToString(), allowing injection of attributes, elements, or processing instructions.
Which versions have a fix?
@xmldom/xmldom is fixed in versions 0.8.14 and 0.9.11. xmldom has no fixed version available; affected releases include 0.6.0 and earlier.
What can be done if upgrading is not immediately possible?
Do not pass untrusted values to Document.createElement(). Enforce XML QName validation on tag names before element creation, and avoid rendering serialized output in browsers when untrusted names may have entered the DOM.