CVE-2026-83609

@xmldom/xmldom versions 0.9.0 through 0.9.11 mishandle QName validation because the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so the ^ and $ anchors validate only a single line instead of the complete XML name. As a result, createElementNS, createAttributeNS, createDocumentType, and createAttribute accept malformed XML names whose first line is valid while later lines — separated by U+000A, U+000D, U+2028, or U+2029 — go unvalidated, and that later text is emitted as injected markup when the document is serialized, including through the requireWellFormed: true path. An attacker who can influence the XML names passed to these APIs can therefore inject arbitrary markup into serialized XML output, yielding a high integrity impact per the CVSS 4.0 score of 8.7, with no rated confidentiality or availability impact. Any JavaScript/Node.js application or library consuming the affected 0.9.x releases of this widely used npm package, where attacker-controlled strings reach the affected APIs, is exposed; users of releases before 0.9.0 or of the fixed 0.9.12 release are not affected. There is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS currently estimates a 0.3% probability of exploitation within 30 days, so no in-the-wild exploitation is known.

What to do: Upgrade @xmldom/xmldom to 0.9.12 or later, including as a transitive dependency (verify with npm ls @xmldom/xmldom). Until patched, avoid passing untrusted strings containing U+000A, U+000D, U+2028, or U+2029 to createElementNS, createAttributeNS, createDocumentType, or createAttribute, and review serialized XML output for injected markup.