CVE-2026-83617

A flaw was found in the @xmldom/xmldom library. The requireWellFormed validation for XML element and attribute names can be bypassed by embedding specific line terminator characters. This allows an attacker to inject malformed XML into the document, potentially leading to XML injection vulnerabilities and bypassing security checks designed to prevent such issues.

Red Hat has evaluated this vulnerability as having an Important severity rating because remote actors can inject arbitrary XML markup into serialized outputs without requiring prior authentication, potentially compromising data integrity across dependent services. To exploit this issue, an affected application must dynamically create DOM element or attribute identifiers directly from unvalidated external input and subsequently serialize the tree using strict well-formedness validation. In standard deployments, user-supplied content is generally restricted to text nodes or attribute values rather than structural tag names, substantially reducing real-world exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.