THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-4w3w-2rp5-g8jm (high) — xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

[GHSA] GHSA-4w3w-2rp5-g8jm (high) — xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

medgithub_advisoriesPublished 2026-09-08

GHSA-4w3w-2rp5-g8jm Severity: high CVE: CVE-2026-83605

xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

## Summary

`Element.setAttribute()` in `@xmldom/xmldom` bypasses attribute name validation by calling the private `_createAttribute(name)` method, which performs no validation. The public `createAttribute()` method correctly validates names against an anchored `Q

Indicators of compromise

Original source: https://github.com/advisories/GHSA-4w3w-2rp5-g8jm