CVE-2026-83605

What it actually does

In vulnerable xmldom/@xmldom/xmldom, Element.setAttribute() routes through private _createAttribute(name) without QName validation, unlike Document.createAttribute(). XMLSerializer.serializeToString() then emits the stored name verbatim, and requireWellFormed:true does not validate attribute names. A crafted name can terminate the intended attribute and inject additional attributes—including HTML event handlers—into serialized output. Synthesized xmlns:PREFIX declarations share the same unchecked-name boundary, so namespace declarations can likewise break out and alter document structure. The result is integrity compromise of serialized XML/HTML that browsers or other consumers will parse as extra attributes rather than a single name.

Why it matters to the business

Applications that serialize attacker-influenced XML or HTML with this library and deliver it to browsers can have their documents silently rewritten, enabling cross-site scripting, session or credential theft, and unauthorized actions in the victim's session. Document, feed, and UI integrity is lost even when well-formedness options are enabled. Downstream products including Red Hat Developer Hub (rhdh) are affected; apply RHSA-2026:69248. The issue is not on CISA KEV, is not associated with ransomware, and has no public exploit maturity about 32 days after publication, but the library-level flaw needs no privileges and can poison any untrusted attribute-name or xmlns path, so internet-facing generators remain a material operational risk until patched or migrated.

How an attack unfolds

An attacker who can influence an attribute name passed to Element.setAttribute()—or a prefix used to synthesize xmlns:PREFIX—supplies a string that is not a valid QName (for example, a name that includes quote, whitespace, or equals characters). The private creation path stores that name without the checks Document.createAttribute() would apply. On serializeToString(), the name is written unchanged, closing the original attribute and appending extra attributes such as event handlers or additional xmlns declarations. If a browser or HTML/XHTML consumer then parses that markup, injected handlers run in the consuming origin or the document's namespaces and attributes are rewritten. requireWellFormed does not stop this path. No named threat actors or KEV-linked campaigns are publicly associated with this issue at this time; exploitation depends on an application accepting untrusted names and serving the serialized result.

How to fix it

Upgrade @xmldom/xmldom to 0.8.14 on the 0.8 line or 0.9.11 on the 0.9 line. The unscoped xmldom package (0.6.0 and earlier) has no patched release; migrate to @xmldom/xmldom at a fixed version and remove the old package. Red Hat Developer Hub (rhdh) users should apply RHSA-2026:69248 (hub-rhel9:1789554285). Compensating controls until upgraded: allowlist attribute names and xmlns prefixes to strict QNames (NCName/QName only); never pass untrusted strings to setAttribute or as namespace prefixes; do not serve xmldom-serialized output as HTML/XHTML to browsers; deploy a Content-Security-Policy that disallows inline event handlers and inline script. Rebuild and redeploy all images and lockfiles that embed the library.

How to confirm the fix worked

Inventory npm/yarn/pnpm lockfiles and container SBOMs for xmldom (<=0.6.0) and @xmldom/xmldom below 0.8.14 (0.8.x) or 0.9.11 (0.9.x). On Red Hat Developer Hub, confirm RHSA-2026:69248 / hub-rhel9:1789554285 is installed. After upgrade, regression-test serialization of documents that set attributes and xmlns prefixes, including names that are not valid QNames, and confirm they are rejected or encoded rather than break out. Verify requireWellFormed and serializer behavior against illegal names. SCA, image scanning, and admission policies should fail builds that still pull vulnerable versions.

Typical attack path

1. Locate an application that accepts user-influenced attribute names, XML fragments, or xmlns prefixes and serializes them with vulnerable xmldom or @xmldom/xmldom.
2. Submit a non-QName attribute name or prefix that breaks out of a single attribute (quote, whitespace, equals, or similar).
3. Trigger Element.setAttribute() or xmlns:PREFIX synthesis so the illegal name is stored without validation.
4. Cause XMLSerializer.serializeToString() to emit the document (requireWellFormed does not reject the name).
5. Deliver the serialized markup to a browser or other HTML/XML consumer.
6. Injected attributes (including event handlers) or namespace declarations take effect in the consumer, altering integrity or executing script in the victim origin.

How to detect it

This is an output-integrity / XSS-class issue; successful abuse leaves poisoned serialized markup rather than a distinct implant. Review application and access logs for requests that set or upload XML/HTML with unusual attribute names (quotes, whitespace, equals, or 'on*' handlers inside names). Inspect stored or cached XML, SVG, XHTML, RSS/Atom, and SOAP/XML responses generated by Node services for attribute-breakout sequences and unexpected event-handler attributes. Check web, WAF, and reverse-proxy logs for reflected or stored markup containing inline handlers in XML content types. On hosts, correlate npm package versions (xmldom, @xmldom/xmldom) in running images with the time window since 2026-09-01. Browser or CSP reports showing inline handler or script violations on endpoints that serialize XML are a strong lead. There are no public in-the-wild payloads or named actor TTPs tied to this CVE; treat findings as suspected output injection, not a confirmed campaign.

• onclick=
• onerror=
• onload=
• onmouseover=
• onfocus=
• onmouseenter=
• onpointerdown=
• javascript:
• xmlns:
• setAttribute(
• serializeToString
• requireWellFormed
• Content-Type: application/xml
• Content-Type: text/xml
• Content-Type: image/svg+xml
• Content-Type: application/xhtml+xml
• @xmldom/xmldom@0.8.
• @xmldom/xmldom@0.9.0
• @xmldom/xmldom@0.9.1
• xmldom@0.6
• " on
• ' on
• " xmlns:

What your security team should do

• Patch or migrate immediately: @xmldom/xmldom 0.8.14 or 0.9.11; replace unscoped xmldom; apply RHSA-2026:69248 for rhdh.
• Hunt lockfiles, images, and SBOMs for xmldom and @xmldom/xmldom and block vulnerable versions in CI.
• Identify code paths that pass user input to setAttribute, setAttributeNS, or xmlns prefix synthesis and restrict names to a QName allowlist.
• Do not serve library-serialized XML as HTML/XHTML; add CSP that blocks inline event handlers where output may hit a browser.
• Prioritize internet-facing document, feed, and UI generators; this is not KEV and has no public exploit maturity, but integrity impact is high and no privileges are required at the library boundary.
• Re-scan after deploy and retain evidence of version upgrades for audit.