Executive brief
xmldom is a popular XML DOM parser library used to parse and serialize XML documents. A validation bypass in element and attribute name creation allows attackers to inject malicious XML markup through embedded line breaks, resulting in XML/HTML injection when the document is serialized—potentially leading to cross-site scripting (XSS) in downstream HTML contexts.
Technical details
xmldom implements WHATWG-mandated creation-time validation for element, attribute, and document-type names via the createElementNS, createAttributeNS, createDocumentType, and createAttribute APIs. These functions route through validateQualifiedName or equivalent checks using g.QName_exact.test(name), where QName_exact is a regex anchored with ^ and $ but compiled with the multiline (m) flag by a shared regex builder. Under the m flag, ^ and $ match line boundaries instead of string boundaries, allowing a name with an embedded ECMAScript LineTerminator (U+000A, U+000D, U+2028, U+2029) to pass validation if the portion before the line terminator is well-formed. The malformed name is stored in the DOM and emitted verbatim during serialization, injecting arbitrary markup into the output. The attack vector is network-based when serialized XML reaches an HTML/XML parser or browser context. The fix (version 0.9.12) removes the m flag from the shared regex builder and explicitly rejects names containing line terminators at creation time and during strict serialization, matching the standard's requirement.
Affected products
- xmldom @xmldom/xmldom 0.9.0 through 0.9.11
Timeline
- 2026-09-08: disclosed: GHSA-3px3-54cx-rmw9 published
- 2026-09-08: patched: Fix released in version 0.9.12