Permissive Regular Expression in xmldom - CVE-2026-83609
Published: August 25, 2026 / Updated: September 2, 2026
Vulnerability identifier: #VU145131
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-83609
CWE-ID: CWE-625
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject markup into serialized XML output.
The vulnerability exists due to permissive regular expression handling in createElementNS, createAttributeNS, createDocumentType, and createAttribute when processing crafted XML names containing an embedded line terminator. A remote attacker can supply a specially crafted qualified name to inject markup into serialized XML output.
When the serialized output is used in an HTML context, this can lead to downstream cross-site scripting. The issue affects the default serialization path, and user interaction is not required.
Affected software
xmldom
How to mitigate CVE-2026-83609
Install security update from vendor's website.
xmldom - update to 0.9.12