CVE-2026-83617: xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QNameexact expression produced by reg() in lib/grammar.js, which inherits the multiline flag. A name with a valid first line followed by U+000A, U+000D, U+2028, or U+2029 and breakout markup therefore passes validation and is emitted verbatim in element start and end tags or attribute names. This bypasses the strict-serialization checks introduced for the earlier element-name and attribute-name injection advisories, while the default serialization path remains outside the strict guarantee. This issue is fixed in @xmldom/xmldom version 0.9.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.9.12
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments using @xmldom/xmldom from 0.9.11 up to, but not including, 0.9.12 are affected when they rely on requireWellFormed: true for element or attribute name validation.
What input is needed to exploit the issue?
An attacker needs influence over an element or attribute name that is serialized. The name must contain a valid first line followed by U+000A, U+000D, U+2028, or U+2029 and breakout markup.
Is the default serialization configuration protected by this check?
No. The default serialization path remains outside the strict guarantee; the bypass specifically defeats the strict validation expected from requireWellFormed: true.
What is the remediation?
Upgrade @xmldom/xmldom to version 0.9.12, which fixes the issue.