CVE-2026-83617: xmldom XMLSerializer requireWellFormed bypass via line terminator

Executive brief

xmldom is a JavaScript library that parses and serializes XML documents. The XMLSerializer component has a security feature (requireWellFormed flag) designed to reject malformed element and attribute names that could be used for XML injection attacks. An attacker can bypass this protection by embedding line-break characters in element names, allowing them to inject arbitrary XML or HTML markup that breaks out of the intended tag structure. Applications relying on this feature to safely serialize untrusted data remain vulnerable unless they update to the patched version.

Technical details

The vulnerability is a regex validation bypass in xmldom's element and attribute name validation. The shared regexp builder uses the multiline flag ('m') when constructing anchored matchers (^…$), causing the anchors to match line boundaries rather than string boundaries. When `requireWellFormed: true` is set, the validator tests element/attribute names using `QName_exact.test(name)`, but the 'm' flag makes ' match at an interior line terminator, accepting any string with at least one valid QName line. An attacker can craft a name like `a\n><script>alert(1)</script` where the first line is valid QName, bypassing the check. The serializer then emits this name verbatim into XML tags, causing the injected markup after the line terminator to break out of the tag structure. This affects programmatically created nodes via `createElement`, `createElementNS`, `createAttribute`, and `createAttributeNS` when serialized with `requireWellFormed: true`. The fix (version 0.9.12) treats line terminators (U+000A, U+000D, U+2028, U+2029) as invalid, rejecting names containing them. The default serialization path (requireWellFormed: false) remains unchanged for backward compatibility.

Affected products

• xmldom @xmldom/xmldom 0.9.11

Timeline

• 2026-09-08: disclosed: GitHub Security Advisory published
• 2026-09-08: patched: Patch released in version 0.9.12

References

• https://api.github.com/users/karfau
• https://github.com/karfau
• https://api.github.com/users/karfau/gists%7B/gist_id%7D
• https://api.github.com/users/karfau/repos
• https://avatars.githubusercontent.com/u/135657?v=4
• https://api.github.com/users/karfau/events%7B/privacy%7D