CVE-2026-83617: xmldom XMLSerializer requireWellFormed bypass via line terminator

CVE-2026-83617 · Severity: high · CVSS 4 · Published 2026-09-01

xmldom is a JavaScript library that parses and serializes XML documents. The XMLSerializer component has a security feature (requireWellFormed flag) designed to reject malformed element and attribute names that could be used for XML injection attacks. An attacker can bypass this protection by embedding line-break characters in element names, allowing them to inject arbitrary XML or HTML markup that breaks out of the intended tag structure. Applications relying on this feature to safely serialize untrusted data remain vulnerable unless they update to the patched version.

Technologies: @xmldom/xmldom (npm). Vendors: npm.

Quick answers

Is CVE-2026-83617 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-83617 being exploited in the wild.
How severe is CVE-2026-83617?
High severity, with a CVSS score of 4, published 1 September 2026.
Which products and versions are affected?
@xmldom/xmldom (npm) = 0.9.11, SEMVER:introduced=0.9.11,fixed=0.9.12.
Is there a fix for CVE-2026-83617?
Yes. @xmldom/xmldom (npm): upgrade to 0.9.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83617 attacked?
It is attacked over the network.
Am I affected by CVE-2026-83617?
Check whether you run @xmldom/xmldom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @xmldom/xmldom (npm): upgrade to 0.9.12 or later
    npm install @xmldom/xmldom@0.9.12

Technical details

The vulnerability is a regex validation bypass in xmldom's element and attribute name validation. The shared regexp builder uses the multiline flag ('m') when constructing anchored matchers (^…$), causing the anchors to match line boundaries rather than string boundaries. When `requireWellFormed: true` is set, the validator tests element/attribute names using `QName_exact.test(name)`, but the 'm' flag makes '$' match at an interior line terminator, accepting any string with at least one valid QName line. An attacker can craft a name like `a\n><script>alert(1)</script` where the first line is valid QName, bypassing the check. The serializer then emits this name verbatim into XML tags, causing the injected markup after the line terminator to break out of the tag structure. This affects programmatically created nodes via `createElement`, `createElementNS`, `createAttribute`, and `createAttributeNS` when serialized with `requireWellFormed: true`. The fix (version 0.9.12) treats line terminators (U+000A, U+000D, U+2028, U+2029) as invalid, rejecting names containing them. The default serialization path (requireWellFormed: false) remains unchanged for backward compatibility.

Affected products

  • xmldom @xmldom/xmldom 0.9.11

Identifiers

  • CVE-2026-83617
  • GHSA-jxjr-3g7g-3944

Timeline

  • 2026-09-08: disclosed: GitHub Security Advisory published
  • 2026-09-08: patched: Patch released in version 0.9.12

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.