CVE-2026-83607

A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. This vulnerability allows a remote attacker to inject malicious content, such as attributes or elements, into serialized XML or HTML documents. This occurs because the Document.createElement() function does not properly validate element names, and the XMLSerializer.serializeToString() function then outputs these unvalidated names directly. When these manipulated documents are processed by a web browser, it can lead to cross-site scripting (XSS), enabling attackers to execute arbitrary scripts in the user's browser.

A flaw was found in the xmldom JavaScript package. Unvalidated tag names passed to Document.createElement() are emitted verbatim during XMLSerializer.serializeToString() processing. An attacker capable of supplying controlled element names can inject arbitrary attributes, nodes, or processing instructions into serialized XML/HTML output. When rendered within a user's browser context, this input validation failure bypasses QName structural constraints and can result in Cross-Site Scripting (XSS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Sanitize or validate all untrusted element names before passing them to Document.createElement(), ensuring input strictly adheres to valid XML QName specifications prior to serialization.