Bug 2526815 (CVE-2026-83609)

Summary: CVE-2026-83609 @xmldom/xmldom: xmldom: Markup injection via embedded line terminators in XML names
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: abarbaro, alizardo, cdrage, gmalinko, janstey, jchui, jhe, ktsao, lchilton, nboldt, oaljalju, pdelbell, psrna, rhel-process-autobot, rstepani, rushinde, sfeifer, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in xmldom. The XML DOM (Document Object Model) parser incorrectly validates XML names, allowing embedded line terminators. This vulnerability enables an attacker to inject additional markup into XML documents during serialization, potentially leading to malformed XML output.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2536907, 2536908, 2536909, 2536910, 2536911, 2536912    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-01 14:44:43 UTC 
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose later text injects markup when serialized through either the default path or requireWellFormed: true. The triggering ECMAScript line terminators are U+000A, U+000D, U+2028, and U+2029. This issue is fixed in @xmldom/xmldom version 0.9.12.