CVE-2026-83617

@xmldom/xmldom 0.9.11 contains a flaw in its strict serialization mode: when requireWellFormed is set to true, element and attribute name validation uses the anchored QName_exact regular expression produced by reg() in lib/grammar.js, which inherits the multiline flag, so the anchors match at embedded line boundaries rather than only at the ends of the name. As a result, a name whose first line is valid but that is followed by a line terminator (U+000A, U+000D, U+2028, or U+2029) and breakout markup passes validation and is emitted verbatim into element start tags, end tags, or attribute names, enabling XML markup injection (CWE-91) that bypasses the strict-serialization checks added in response to earlier element-name and attribute-name injection advisories. An attacker who can influence names in parsed XML, for example by supplying an untrusted document that an application re-serializes, gains integrity impact, consistent with the CVSS 4.0 score of 8.7 with high integrity impact and no confidentiality or availability impact. Only consumers of @xmldom/xmldom 0.9.11 on npm that enable the requireWellFormed: true strict-serialization setting are affected, and the default serialization path remains outside the strict guarantee. No exploitation is known: there is no public proof of concept, the issue is not in CISA KEV, and EPSS estimates a 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade @xmldom/xmldom to 0.9.12 or later, including transitive copies (check with npm ls @xmldom/xmldom or your software-composition-analysis tooling). Until upgraded, do not rely on requireWellFormed: true strict serialization for attacker-influenced documents, or strip or reject names containing U+000A, U+000D, U+2028, or U+2029 before serialization. Note that the default serialization path was never covered by the strict guarantee, so do not treat its output as strictly validated regardless of version.