CVE-2026-83611— xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content
Quick assessment
Affected
xmldom xmldom
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
xmldom 是一个纯 JavaScript 实现的、基于 W3C 标准（XML DOM Level 2 Core）的 DOMParser 和 XMLSerializer 模块。 在 @xmldom/xmldom 0.8.15 和 0.9.12 之前的版本，以及 xmldom 0.6.0 及更早的版本中， 方法会静默接受像 这样的结束标签：它会闭合元素，并丢弃标签后的多余内容（即 ）。 在 0.9.x 版本中， 中的结束标签验证器从 函数继承了“多行标志”（multiline flag），使得第一行内容能够满足锚定
Possible ATT&CK Techniques 1 AI
T1212 · Exploitation for Credential Access
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-83611
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content
Source: CVE Program / CVE List V5
Vulnerability Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString() can silently accept an end tag such as </a\njunk>, close the element, and discard the trailing content. On 0.9.x, the lib/sax.js end-tag validator inherits the multiline flag from reg(), allowing the first line to satisfy the anchored XML ETag production; older lines have no equivalent residue validation. This parser differential can bypass a parse-before-trust well-formedness gate, although it does not inject the discarded content; onError on 0.9.x and errorHandler on 0.8.x are the relevant reporting interfaces. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1286
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-83611
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-83611
请登录查看更多情报信息。
Other References for CVE-2026-83611 (7)
-
https://github.com/xmldom/xmldom/pull/1071 x_refsource_MISC
-
https://github.com/xmldom/xmldom/pull/1072 x_refsource_MISC
-
https://github.com/xmldom/xmldom/releases/tag/0.8.15 x_refsource_MISC
-
https://github.com/xmldom/xmldom/releases/tag/0.9.12 x_refsource_MISC
-
https://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59 x_refsource_CONFIRM
Same Patch Batch · xmldom · 2026-09-01 · 10 CVEs total
| CVE-2026-83605 | 8.7 HIGH | xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed |
| CVE-2026-83606 | 8.7 HIGH | xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructi |
| CVE-2026-83607 | 8.7 HIGH | xmldom: Element name injection via createElement() bypasses requireWellFormed |
| CVE-2026-83609 | 8.7 HIGH | xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line termina |
| CVE-2026-83613 | 8.7 HIGH | xmldom: Quadratic-time attribute deduplication |
| CVE-2026-83612 | 8.7 HIGH | xmldom: HTML raw-text closing-tag case mismatch causes output amplification |
| CVE-2026-83614 | 8.7 HIGH | xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartP |
| CVE-2026-83608 | 8.7 HIGH | xmldom: DocType `name` Injection Bypasses requireWellFormed |
| CVE-2026-83610 | 6.3 MEDIUM | xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellForm |
IV. Related Vulnerabilities
Same product: xmldom
-
CVE-2026-83614
xmldom: Quadratic-time parsing via the malformed-input recov -
CVE-2026-83613
xmldom: Quadratic-time attribute deduplication -
CVE-2026-83612
xmldom: HTML raw-text closing-tag case mismatch causes outpu -
CVE-2026-83610
xmldom: XML fragment injection via invalid EntityReference.n -
CVE-2026-83609
xmldom: Creation-time XML Name/QName validation is bypassabl
Same vendor: xmldom
-
CVE-2026-83614
xmldom: Quadratic-time parsing via the malformed-input recov -
CVE-2026-83613
xmldom: Quadratic-time attribute deduplication -
CVE-2026-83612
xmldom: HTML raw-text closing-tag case mismatch causes outpu -
CVE-2026-83610
xmldom: XML fragment injection via invalid EntityReference.n -
CVE-2026-83609
xmldom: Creation-time XML Name/QName validation is bypassabl
Same weakness: CWE-1286
-
CVE-2026-0931
Denial-of-service vulnerability in M-Files Server -
CVE-2026-25292
Improper Validation of Syntactic Correctness of Input in Aut -
CVE-2026-57026
Junos OS: MX Series with SPC3, SRX Series: Processing of a s -
CVE-2025-8873
Arista EOS Dataplane Denial of Service via Malformed IPsec P -
CVE-2019-25720
Dräger SC Monitoring Devices DoS via Malformed Network Packe
V. Comments for CVE-2026-83611
No comments yet