Количество 7
Количество 7
BDU:2026-14133
Уязвимость метода Element.setAttribute() модуля определения способа доступа к документам XML и управления ими XMLDOM, позволяющая нарушителю проводить межсайтовые сценарные атаки (XSS)
CVE-2026-83605
(xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) ...)
CVE-2026-83605
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private _createAttribute(name) path without validating the attribute name, while Document.createAttribute(name) validates against QName. XMLSerializer.serializeToString() emits attribute names verbatim, and requireWellFormed: true did not validate them, so a crafted name can terminate the intended attribute and inject additional attributes, including event handlers, into browser-consumed output; synthesized xmlns:PREFIX declarations expose the same unchecked-name boundary. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.
CVE-2026-83605
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private _createAttribute(name) path without validating the attribute name, while Document.createAttribute(name) validates against QName. XMLSerializer.serializeToString() emits attribute names verbatim, and requireWellFormed: true did not validate them, so a crafted name can terminate the intended attribute and inject additional attributes, including event handlers, into browser-consumed output; synthesized xmlns:PREFIX declarations expose the same unchecked-name boundary. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.
CVE-2026-83605
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
CVE-2026-83605
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) ...
GHSA-4w3w-2rp5-g8jm
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | BDU:2026-14133 Уязвимость метода Element.setAttribute() модуля определения способа доступа к документам XML и управления ими XMLDOM, позволяющая нарушителю проводить межсайтовые сценарные атаки (XSS) | CVSS3: 7.5 | 0% Низкий | около 1 месяца назад |
 | CVE-2026-83605 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) ...) | 0% Низкий | 15 дней назад | |
 | CVE-2026-83605 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private _createAttribute(name) path without validating the attribute name, while Document.createAttribute(name) validates against QName. XMLSerializer.serializeToString() emits attribute names verbatim, and requireWellFormed: true did not validate them, so a crafted name can terminate the intended attribute and inject additional attributes, including event handlers, into browser-consumed output; synthesized xmlns:PREFIX declarations expose the same unchecked-name boundary. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom. | CVSS3: 8.1 | 0% Низкий | 15 дней назад |
 | CVE-2026-83605 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private _createAttribute(name) path without validating the attribute name, while Document.createAttribute(name) validates against QName. XMLSerializer.serializeToString() emits attribute names verbatim, and requireWellFormed: true did not validate them, so a crafted name can terminate the intended attribute and inject additional attributes, including event handlers, into browser-consumed output; synthesized xmlns:PREFIX declarations expose the same unchecked-name boundary. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom. | 0% Низкий | 15 дней назад | |
 | CVE-2026-83605 xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed | 0% Низкий | 10 дней назад | |
| CVE-2026-83605 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) ... | 0% Низкий | 15 дней назад | |
| GHSA-4w3w-2rp5-g8jm xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed | 0% Низкий | 8 дней назад |
Уязвимостей на страницу