THREAT OPS › Threat News › [GHSA] GHSA-w2rr-34g9-rvrj (high) — xmldom: Element name injection via createElement() bypasses requireWellFormed
[GHSA] GHSA-w2rr-34g9-rvrj (high) — xmldom: Element name injection via createElement() bypasses requireWellFormed
GHSA-w2rr-34g9-rvrj Severity: high CVE: CVE-2026-83607
xmldom: Element name injection via createElement() bypasses requireWellFormed
## Summary
`Document.createElement()` in `@xmldom/xmldom` accepts arbitrary strings as the `tagName` parameter with zero validation. The serializer emits the tag name verbatim into XML/HTML output. Critically, the `requireWellFormed: true` serializer option — the
Indicators of compromise
- CVE-2026-83607cve
- CVE-2026-41672cve
- CVE-2026-41674cve
- CVE-2026-34601cve
Original source: https://github.com/advisories/GHSA-w2rr-34g9-rvrj