CVE-2026-83605

A flaw was found in xmldom, a JavaScript XML DOM parser. The Element.setAttribute() function does not properly validate attribute names, allowing a remote attacker to inject specially crafted attribute names. This can lead to the injection of additional attributes, including event handlers, into browser-consumed output. Consequently, a remote attacker could achieve client-side script execution, such as Cross-Site Scripting (XSS), in the context of the affected application.

This is an Important flaw in xmldom that allows attribute injection, potentially leading to client-side script execution. An attacker could craft malicious XML input that, when processed by an application using xmldom and subsequently rendered in a browser-like environment, could execute arbitrary scripts. This risk is primarily present in applications that handle untrusted XML data and display it to users.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.