Node xmldom: From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $… (CVE-2026-83609)
Description
The node-xmldom library versions from 0.9.0 up to 0.9.12 contain a vulnerability in the shared reg() builder in lib/grammar.js. This builder compiles the anchored QName_exact validator with the multiline flag, causing ^ and $ anchors to validate only one line instead of the entire XML name. As a result, certain XML creation functions accept malformed XML names that include line terminators, potentially injecting markup when serialized. This issue is fixed in version 0.9.12.
CVSS v4.0
Affected software
pkg:deb/ubuntu/node-xmldom?arch=source&distro=focalpkg:deb/ubuntu/node-xmldom?arch=source&distro=jammypkg:deb/ubuntu/node-xmldom?arch=source&distro=noblepkg:deb/ubuntu/node-xmldom?arch=source&distro=stonkingpkg:deb/ubuntu/node-xmldom?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In node-xmldom versions 0.9.0 through 0.9.12, the QName_exact validator in lib/grammar.js is compiled with the multiline flag, causing the ^ and $ anchors to validate only a single line rather than the full name. This allows functions such as createElementNS, createAttributeNS, createDocumentType, and createAttribute to accept malformed XML names containing line terminators (U+000A, U+000D, U+2028, U+2029). When serialized, these malformed names can inject markup, violating XML well-formedness constraints. The vulnerability is resolved in @xmldom/xmldom version 0.9.12.
Potential Impact
The vulnerability allows malformed XML names with embedded line terminators to be accepted and serialized, potentially leading to injection of unintended markup. This could affect XML processing integrity in applications using affected versions of node-xmldom. There is no indication of privilege escalation or remote code execution. The CVSS 4.0 vector rates this as medium severity with no attack vector, complexity, privileges, or user interaction required, but with high impact on integrity.
Mitigation Recommendations
Upgrade to @xmldom/xmldom version 0.9.12 or later, where this issue is fixed. No other mitigation or temporary workaround is indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-83609
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 4.0
Threat ID: 6ad3f55e2cdf04f65666181d
Added to database: 10/17/2026, 22:23:26 UTC
Last enriched: 10/17/2026, 23:30:40 UTC
Last updated: 10/17/2026, 23:30:40 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.