CVE-2026-83607

The xmldom library (maintained as @xmldom/xmldom on npm) fails to validate the qualified name passed to Document.createElement(), and XMLSerializer.serializeToString() emits that name verbatim, violating the XML QName constraint; the requireWellFormed: true path also does not validate the element name or the synthesized xmlns:PREFIX declaration. An attacker who controls tag names in documents that are created or serialized can inject attributes, elements, or processing instructions into the resulting XML or HTML. When that serialized output is consumed in a browser, the injected markup can lead to cross-site scripting and tampering with downstream XML consumers. Any JavaScript project using the affected npm packages to create or serialize attacker-influenced XML is affected: @xmldom/xmldom users prior to 0.8.14 and 0.9.11, and users of the legacy xmldom package 0.6.0 and earlier, for which no fixed version exists. No exploitation is currently known: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation within 30 days.

What to do: Upgrade @xmldom/xmldom to 0.8.14 or 0.9.11 depending on your release line; for the legacy xmldom package (0.6.0 and earlier) no fixed version is available, so migrate to the maintained @xmldom/xmldom package. Audit whether your application passes attacker-controlled tag names to createElement() or serializes attacker-influenced XML/HTML into browser-facing output, and as an interim measure validate/escape element names at the application layer.