CVE-2026-83617
Summary
An embedded line terminator bypasses the requireWellFormed serializer check for element and
attribute names. The check was added to fix GHSA-w2rr-34g9-rvrj and GHSA-4w3w-2rp5-g8jm; a name whose
first line is well-formed slips past it and is serialized verbatim, so the characters after the line
terminator break out of the start/end tag or attribute. Callers who enabled requireWellFormed
specifically to neutralize those name-injection issues remain exposed.
Details
xmldom builds every grammar production through a shared regexp builder that compiles with the m
flag. The anchored full-string matcher used for element and attribute names, `QName_exact =
reg('^', QName, '$'), therefore inherits m. When it is applied as QName_exact.test(name)` against
an already-assembled node name, the m flag makes $ match at an interior line terminator, so the
matcher accepts any value in which at least one line is a valid QName; the other lines are never
constrained. A payload whose first line is a valid QName, followed by a line terminator and breakout
markup, is what yields a working injection.
The serializer emits the accepted name verbatim into element start/end tags and attribute names, so
the bytes after the line terminator break out of the intended syntactic position. The check is
reached whenever a caller serializes, with requireWellFormed: true, a node whose name was set
through programmatic DOM construction (createElement, createElementNS, createAttribute,
createAttributeNS) with attacker-influenced input.
Root Cause
1. A shared regexp builder compiles anchored productions with the m flag.
2. ^…$ under m are line anchors, not string anchors.
3. A full-string validator built on such a production (.test()) accepts any string with one
conforming line, so a line terminator followed by breakout markup passes.
The triggering line terminators are the ECMAScript LineTerminator set: U+000A, U+000D, U+2028, U+2029.
Proof of Concept
const { DOMImplementation, XMLSerialize
⚡ Watch CVE-2026-83617
Get an email if CVE-2026-83617 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-83617)