Most recent entries from all

bdu:2026-14134

EUVD-2026-362690

fkie_cve-2026-83609

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose later text injects markup when serialized through either the default path or requireWellFormed: true. The triggering ECMAScript line terminators are U+000A, U+000D, U+2028, and U+2029. This issue is fixed in @xmldom/xmldom version 0.9.12.

GHSA-3px3-54cx-rmw9 — xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on th…

Affected: npm: @xmldom/xmldom

## Summary

An embedded line terminator bypasses xmldom's always-on, WHATWG-mandated creation-time name validation. `createElementNS`, `createAttributeNS`, `createDocumentType`, and `createAttribute` should reject a malformed qualified name with `InvalidCharacterError`, but a name whose first line is well-formed slips through and enters the DOM. On serialization it is emitted verbatim, so the characters after the line terminator inject markup into the output. The injection reaches the default serialization path, and enabling `requireWellFormed` does not prevent it.

## Details

`createElementNS`, `createAttributeNS`, and `createDocumentType` route through `validateQualifiedName`, and `createAttribute` performs the analogous check; each validates the name with `g.QName_exact.test(name)`. `QName_exact = reg('^', QName, '$')` inherits the `m` flag from xmldom's shared regexp builder, so the matcher accepts any name whose first line is a valid `QName` and leaves the remaining lines unconstrained (see Root Cause).

### Root Cause

1. A shared regexp builder compiles anchored productions with the `m` flag. 2. `^…$` under `m` are line anchors, not string anchors. 3. `validateQualifiedName` / `createAttribute` validate with `.test()` against such a production, so a line terminator followed by breakout markup passes and the malformed name is stored.

The triggering line terminators are the ECMAScript `LineTerminator` set: U+000A, U+000D, U+2028, U+2029.

## Proof of Concept

```js…

UBUNTU-CVE-2026-83609

Affected: Ubuntu:20.04:LTS: node-xmldom, Ubuntu:22.04:LTS: node-xmldom, Ubuntu:24.04:LTS: node-xmldom, Ubuntu:26.04:LTS: node-xmldom

WID-SEC-W-2026-3596 — IBM App Connect Enterprise: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um einen Cross-Site Scripting Angriff durchzuführen.