CVE-2026-83611

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-83611", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-31T20:36:25.744Z", "datePublished": "2026-09-01T14:34:12.618Z", "dateUpdated": "2026-09-01T14:53:37.513Z"}, "containers": {"cna": {"title": "xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content", "problemTypes": [{"descriptions": [{"cweId": "CWE-1286", "lang": "en", "description": "CWE-1286: Improper Validation of Syntactic Correctness of Input", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59"}, {"name": "https://github.com/xmldom/xmldom/pull/1071", "tags": ["x_refsource_MISC"], "url": "https://github.com/xmldom/xmldom/pull/1071"}, {"name": "https://github.com/xmldom/xmldom/pull/1072", "tags": ["x_refsource_MISC"], "url": "https://github.com/xmldom/xmldom/pull/1072"}, {"name": "https://github.com/xmldom/xmldom/commit/4430189660b0d380ee9c9ee7550a1358688e8828", "tags": ["x_refsource_MISC"], "url": "https://github.com/xmldom/xmldom/commit/4430189660b0d380ee9c9ee7550a1358688e8828"}, {"name": "https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362", "tags": ["x_refsource_MISC"], "url": "https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362"}, {"name": "https://github.com/xmldom/xmldom/releases/tag/0.8.15", "tags": ["x_refsource_MISC"], "url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15"}, {"name": "https://github.com/xmldom/xmldom/releases/tag/0.9.12", "tags": ["x_refsource_MISC"], "url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12"}], "affected": [{"vendor": "xmldom", "product": "xmldom", "versions": [{"version": "<= 0.6.0", "status": "affected"}]}, {"vendor": "@xmldom", "product": "xmldom", "versions": [{"version": ">= 0.9.0, < 0.9.12", "status": "affected"}, {"version": ">= 0.7.0, < 0.8.15", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-01T14:34:12.618Z"}, "descriptions": [{"lang": "en", "value": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString() can silently accept an end tag such as </a\\njunk>, close the element, and discard the trailing content. On 0.9.x, the lib/sax.js end-tag validator inherits the multiline flag from reg(), allowing the first line to satisfy the anchored XML ETag production; older lines have no equivalent residue validation. This parser differential can bypass a parse-before-trust well-formedness gate, although it does not inject the discarded content; onError on 0.9.x and errorHandler on 0.8.x are the relevant reporting interfaces. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom."}], "source": {"advisory": "GHSA-6h8r-xr42-gp59", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-01T14:53:15.050065Z", "id": "CVE-2026-83611", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-01T14:53:37.513Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-83611", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-01T14:53:15.050065Z"}}}], "references": [{"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-01T14:53:26.076Z"}}], "cna": {"title": "xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content", "source": {"advisory": "GHSA-6h8r-xr42-gp59", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "xmldom", "product": "xmldom", "versions": [{"status": "affected", "version": "<= 0.6.0"}]}, {"vendor": "@xmldom", "product": "xmldom", "versions": [{"status": "affected", "version": ">= 0.9.0, < 0.9.12"}, {"status": "affected", "version": ">= 0.7.0, < 0.8.15"}]}], "references": [{"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59", "name": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/xmldom/xmldom/pull/1071", "name": "https://github.com/xmldom/xmldom/pull/1071", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/xmldom/xmldom/pull/1072", "name": "https://github.com/xmldom/xmldom/pull/1072", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/xmldom/xmldom/commit/4430189660b0d380ee9c9ee7550a1358688e8828", "name": "https://github.com/xmldom/xmldom/commit/4430189660b0d380ee9c9ee7550a1358688e8828", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362", "name": "https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15", "name": "https://github.com/xmldom/xmldom/releases/tag/0.8.15", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12", "name": "https://github.com/xmldom/xmldom/releases/tag/0.9.12", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString() can silently accept an end tag such as </a\\njunk>, close the element, and discard the trailing content. On 0.9.x, the lib/sax.js end-tag validator inherits the multiline flag from reg(), allowing the first line to satisfy the anchored XML ETag production; older lines have no equivalent residue validation. This parser differential can bypass a parse-before-trust well-formedness gate, although it does not inject the discarded content; onError on 0.9.x and errorHandler on 0.8.x are the relevant reporting interfaces. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1286", "description": "CWE-1286: Improper Validation of Syntactic Correctness of Input"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-01T14:34:12.618Z"}}}, "cveMetadata": {"cveId": "CVE-2026-83611", "state": "PUBLISHED", "dateUpdated": "2026-09-01T14:53:37.513Z", "dateReserved": "2026-08-31T20:36:25.744Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-01T14:34:12.618Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "xmldom", "vendor": "xmldom", "versions": [{"status": "affected", "version": "<= 0.6.0"}]}, {"product": "xmldom", "vendor": "@xmldom", "versions": [{"status": "affected", "version": ">= 0.9.0, < 0.9.12"}, {"status": "affected", "version": ">= 0.7.0, < 0.8.15"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString() can silently accept an end tag such as </a\\njunk>, close the element, and discard the trailing content. On 0.9.x, the lib/sax.js end-tag validator inherits the multiline flag from reg(), allowing the first line to satisfy the anchored XML ETag production; older lines have no equivalent residue validation. This parser differential can bypass a parse-before-trust well-formedness gate, although it does not inject the discarded content; onError on 0.9.x and errorHandler on 0.8.x are the relevant reporting interfaces. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom."}], "id": "CVE-2026-83611", "lastModified": "2026-09-08T21:11:31.703", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-83611", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-01T14:53:15.050065Z", "version": "2.0.3"}}]}, "published": "2026-09-01T15:17:39.263", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/xmldom/xmldom/commit/4430189660b0d380ee9c9ee7550a1358688e8828"}, {"source": "security-advisories@github.com", "url": "https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362"}, {"source": "security-advisories@github.com", "url": "https://github.com/xmldom/xmldom/pull/1071"}, {"source": "security-advisories@github.com", "url": "https://github.com/xmldom/xmldom/pull/1072"}, {"source": "security-advisories@github.com", "url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15"}, {"source": "security-advisories@github.com", "url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12"}, {"source": "security-advisories@github.com", "url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1286"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "xmldom: xmldom: Malformed XML end tag parsing leads to content discard and security bypass", "id": "2526838", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526838"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-1286", "details": ["A flaw was found in xmldom, a JavaScript XML DOM parser. The DOMParser.parseFromString() function can silently accept malformed XML end tags that include a line break and additional content. This unexpected parsing behavior causes the parser to close the element prematurely and discard the trailing content. This could potentially bypass security checks that rely on strict XML well-formedness, leading to data loss or misinterpretation in applications processing untrusted XML input."], "name": "CVE-2026-83611", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift4/ose-console", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-01T14:34:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-83611\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-83611\nhttps://github.com/xmldom/xmldom/commit/4430189660b0d380ee9c9ee7550a1358688e8828\nhttps://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362\nhttps://github.com/xmldom/xmldom/pull/1071\nhttps://github.com/xmldom/xmldom/pull/1072\nhttps://github.com/xmldom/xmldom/releases/tag/0.8.15\nhttps://github.com/xmldom/xmldom/releases/tag/0.9.12\nhttps://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.6.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "xmldom", "source": "cna", "vendor": "xmldom"}, "product": "xmldom", "vendor": "xmldom"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.9.0,0.9.12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.7.0,0.8.15)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "xmldom", "source": "cna", "vendor": "@xmldom"}, "product": "xmldom", "vendor": "xmldom"}], "created": "2026-09-01T15:45:04.993138+00:00", "updated": "2026-09-01T16:30:17.860974+00:00", "vendors": ["xmldom", "xmldom$PRODUCT$xmldom"]}