{"id":"CVE-2026-83609","aliases":["CLSA-2026-1790760268","CLSA-2026-1791987856","CLSA-2026-1793108546","DEBIAN-CVE-2026-83609","EUVD-2026-69220","GHSA-3px3-54cx-rmw9","ROOT-APP-NPM-CVE-2026-83609","UBUNTU-CVE-2026-83609"],"status":"published","title":"xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path","description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose later text injects markup when serialized through either the default path or requireWellFormed: true. The triggering ECMAScript line terminators are U+000A, U+000D, U+2028, and U+2029. This issue is fixed in @xmldom/xmldom version 0.9.12.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00543,"percentile":0.45876,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-625","CWE-91"],"published":"2026-09-01T14:29:40Z","modified":"2026-10-28T02:30:29Z","fixes":[{"ecosystem":"npm","package":"@xmldom/xmldom","fixed_in":["0.9.12"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"@xmldom/xmldom","fixed_in":["0.7.13-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-xmldom","fixed_in":["0.9.12-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@xmldom/xmldom","fixed_in":["0.9.11-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/xmldom__xmldom","fixed_in":["0.9.11-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@xmldom/xmldom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"last_affected":"0.9.11"},{"fixed":"0.9.12"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@xmldom/xmldom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.10-tuxcare.0"},{"fixed":"0.9.10-tuxcare.2"}]}],"versions":["0.9.10","0.9.10-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@xmldom/xmldom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.8-tuxcare.0"},{"fixed":"0.9.8-tuxcare.5"}]}],"versions":["0.9.8","0.9.8-tuxcare.1","0.9.8-tuxcare.2","0.9.8-tuxcare.3","0.9.8-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@xmldom/xmldom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.13-tuxcare.0"},{"fixed":"0.7.13-tuxcare.3"}]}],"versions":["0.7.13","0.7.13-tuxcare.1","0.7.13-tuxcare.2"]},{"source":"osv","ecosystem":"Debian:12","package":"node-xmldom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.6-1","0.9.10-1","0.9.10-2","0.9.11-1","0.9.12-1","0.9.5-1","0.9.6-1","0.9.8-1","0.9.8-2","0.9.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-xmldom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.10-1","0.9.10-2","0.9.11-1","0.9.12-1","0.9.6-1","0.9.8-1","0.9.8-2","0.9.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-xmldom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-1"}]}],"versions":["0.9.10-1","0.9.10-2","0.9.11-1","0.9.6-1","0.9.8-1","0.9.8-2","0.9.9-1"]},{"source":"osv","ecosystem":"npm","package":"@xmldom/xmldom","ranges":[{"type":"SEMVER","events":[{"introduced":"0.9.0"},{"fixed":"0.9.12"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@xmldom/xmldom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/xmldom__xmldom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.11-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-xmldom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.27+ds-1","0.1.27+ds-1+deb10u2build0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-xmldom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.0-1","0.7.3-1","0.7.5-1","0.7.5-1ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-xmldom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-xmldom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.8-2","0.9.10-2","0.9.11-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-xmldom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.6-1","0.9.8-1","0.9.8-2"]}],"products":[{"vendor":"@xmldom","product":"xmldom"},{"vendor":"xmldom","product":"xmldom"}],"references":[{"url":"https://github.com/xmldom/xmldom/security/advisories/GHSA-3px3-54cx-rmw9","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/xmldom/xmldom/pull/1071","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/xmldom/xmldom/releases/tag/0.9.12","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83609","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3px3-54cx-rmw9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83609.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-83609","tags":["advisory"]},{"url":"https://github.com/xmldom/xmldom","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-83609","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-83609","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-83609","title":"xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path","description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose later text injects markup when serialized through either the default path or requireWellFormed: true. The triggering ECMAScript line terminators are U+000A, U+000D, U+2028, and U+2029. This issue is fixed in @xmldom/xmldom version 0.9.12.","status":"published","published":"2026-09-01T14:29:40.475Z","modified":"2026-09-01T18:10:19.349Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-91","CWE-625"],"updated_at":"2026-11-02T13:44:51.734189Z"}],"euvd":[{"id":"EUVD-2026-69220","description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose later text injects markup when serialized through either the default path or requireWellFormed: true. The triggering ECMAScript line terminators are U+000A, U+000D, U+2028, and U+2029. This issue is fixed in @xmldom/xmldom version 0.9.12.","status":"published","published":"2026-09-01T14:29:40Z","modified":"2026-09-01T18:10:19Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:17.32054Z"}],"ghsa":[{"id":"GHSA-3px3-54cx-rmw9","title":"xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path","description":"## Summary\n\nAn embedded line terminator bypasses xmldom's always-on, WHATWG-mandated creation-time name\nvalidation. `createElementNS`, `createAttributeNS`, `createDocumentType`, and `createAttribute` should\nreject a malformed qualified name with `InvalidCharacterError`, but a name whose first line is\nwell-formed slips through and enters the DOM. On serialization it is emitted verbatim, so the\ncharacters after the line terminator inject markup into the output. The injection reaches the default\nserialization path, and enabling `requireWellFormed` does not prevent it.\n\n## Details\n\n`createElementNS`, `createAttributeNS`, and `createDocumentType` route through `validateQualifiedName`,\nand `createAttribute` performs the analogous check; each validates the name with\n`g.QName_exact.test(name)`. `QName_exact = reg('^', QName, '$')` inherits the `m` flag from xmldom's\nshared regexp builder, so the matcher accepts any name whose first line is a valid `QName` and leaves\nthe remaining lines unconstrained (see Root Cause).\n\n### Root Cause\n\n1. A shared regexp builder compiles anchored productions with the `m` flag.\n2. `^…$` under `m` are line anchors, not string anchors.\n3. `validateQualifiedName` / `createAttribute` validate with `.test()` against such a production, so a\n   line terminator followed by breakout markup passes and the malformed name is stored.\n\nThe triggering line terminators are the ECMAScript `LineTerminator` set: U+000A, U+000D, U+2028, U+2029.\n\n## Proof of Concept\n\n```js\nconst { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');\nconst impl = new DOMImplementation();\n\nconst doc = impl.createDocument('urn:x', 'root', null);\nconst el = doc.createElementNS('urn:x', 'a\\n\u003e\u003cscript\u003ex\u003c/script');  // ACCEPTED (no throw)\ndoc.documentElement.appendChild(el);\n\n// DEFAULT serialization — requireWellFormed NOT set:\nconsole.log(new XMLSerializer().serializeToString(doc));\n// Observed: \u003croot xmlns=\"urn:x\"\u003e\u003ca\n// \u003e\u003cscript\u003ex\u003c/script/\u003e\u003c/root\u003e          \u003c-- injected element on the default path\n// Control: createElementNS('urn:x', 'bad\u003ename') throws InvalidCharacterError, confirming the check is\n// active and specifically bypassed by the line terminator.\n```\n\n## Impact\n\n- **Bypass of the always-on WHATWG creation-time name validation** (`InvalidCharacterError`): a\n  malformed name the standard requires be rejected at creation is instead admitted to the DOM.\n- **Markup / structure injection.** An application relying on the `create*` APIs to reject malformed\n  names (the standard behavior) as a trust boundary is exposed; where the serialized output reaches an\n  HTML context, downstream XSS.\n- **No serializer option mitigates it.** The admitted name is emitted verbatim under *both* the default\n  path and `requireWellFormed: true` — the strict serializer shares the same `m`-flagged blind spot\n  (the subject of the sibling serializer advisories) — so the bypassed creation-time check was the only\n  layer that could have stopped it. Demonstrated for all four `create*` sites in\n  `poc_creation_strict_serialization_bypass.cjs`.\n\n## Fix Applied\n\n`createElementNS`, `createAttributeNS`, `createDocumentType`, and `createAttribute` now reject a name\ncontaining a line terminator with `InvalidCharacterError` — the same result they already give for\nother malformed names — because name validation now applies to the whole string. The\n`requireWellFormed` serializer's name checks are corrected by the same change. The fix is\nnon-breaking: such a name was already invalid, and no previously-accepted well-formed name is affected.","status":"published","published":"2026-09-08T21:02:33Z","modified":"2026-09-08T21:02:34Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-91","CWE-625"],"updated_at":"2026-11-02T14:41:14.764963Z"}],"nvd":[{"id":"CVE-2026-83609","description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose later text injects markup when serialized through either the default path or requireWellFormed: true. The triggering ECMAScript line terminators are U+000A, U+000D, U+2028, and U+2029. This issue is fixed in @xmldom/xmldom version 0.9.12.","status":"published","published":"2026-09-01T15:17:38.953Z","modified":"2026-09-08T21:11:31.703Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-91","CWE-625"],"updated_at":"2026-11-02T14:12:43.04945Z"}],"osv":[{"id":"CVE-2026-83609","title":"xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path","description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose later text injects markup when serialized through either the default path or requireWellFormed: true. The triggering ECMAScript line terminators are U+000A, U+000D, U+2028, and U+2029. This issue is fixed in @xmldom/xmldom version 0.9.12.","status":"published","published":"2026-09-01T14:29:40.475Z","modified":"2026-10-28T02:30:29.368768479Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-625","CWE-91"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"DEBIAN-CVE-2026-83609","description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose later text injects markup when serialized through either the default path or requireWellFormed: true. The triggering ECMAScript line terminators are U+000A, U+000D, U+2028, and U+2029. This issue is fixed in @xmldom/xmldom version 0.9.12.","status":"published","published":"2026-09-01T15:17:38.953Z","modified":"2026-10-01T03:03:43.236863357Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"GHSA-3px3-54cx-rmw9","title":"xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path","description":"## Summary\n\nAn embedded line terminator bypasses xmldom's always-on, WHATWG-mandated creation-time name\nvalidation. `createElementNS`, `createAttributeNS`, `createDocumentType`, and `createAttribute` should\nreject a malformed qualified name with `InvalidCharacterError`, but a name whose first line is\nwell-formed slips through and enters the DOM. On serialization it is emitted verbatim, so the\ncharacters after the line terminator inject markup into the output. The injection reaches the default\nserialization path, and enabling `requireWellFormed` does not prevent it.\n\n## Details\n\n`createElementNS`, `createAttributeNS`, and `createDocumentType` route through `validateQualifiedName`,\nand `createAttribute` performs the analogous check; each validates the name with\n`g.QName_exact.test(name)`. `QName_exact = reg('^', QName, '$')` inherits the `m` flag from xmldom's\nshared regexp builder, so the matcher accepts any name whose first line is a valid `QName` and leaves\nthe remaining lines unconstrained (see Root Cause).\n\n### Root Cause\n\n1. A shared regexp builder compiles anchored productions with the `m` flag.\n2. `^…$` under `m` are line anchors, not string anchors.\n3. `validateQualifiedName` / `createAttribute` validate with `.test()` against such a production, so a\n   line terminator followed by breakout markup passes and the malformed name is stored.\n\nThe triggering line terminators are the ECMAScript `LineTerminator` set: U+000A, U+000D, U+2028, U+2029.\n\n## Proof of Concept\n\n```js\nconst { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');\nconst impl = new DOMImplementation();\n\nconst doc = impl.createDocument('urn:x', 'root', null);\nconst el = doc.createElementNS('urn:x', 'a\\n\u003e\u003cscript\u003ex\u003c/script');  // ACCEPTED (no throw)\ndoc.documentElement.appendChild(el);\n\n// DEFAULT serialization — requireWellFormed NOT set:\nconsole.log(new XMLSerializer().serializeToString(doc));\n// Observed: \u003croot xmlns=\"urn:x\"\u003e\u003ca\n// \u003e\u003cscript\u003ex\u003c/script/\u003e\u003c/root\u003e          \u003c-- injected element on the default path\n// Control: createElementNS('urn:x', 'bad\u003ename') throws InvalidCharacterError, confirming the check is\n// active and specifically bypassed by the line terminator.\n```\n\n## Impact\n\n- **Bypass of the always-on WHATWG creation-time name validation** (`InvalidCharacterError`): a\n  malformed name the standard requires be rejected at creation is instead admitted to the DOM.\n- **Markup / structure injection.** An application relying on the `create*` APIs to reject malformed\n  names (the standard behavior) as a trust boundary is exposed; where the serialized output reaches an\n  HTML context, downstream XSS.\n- **No serializer option mitigates it.** The admitted name is emitted verbatim under *both* the default\n  path and `requireWellFormed: true` — the strict serializer shares the same `m`-flagged blind spot\n  (the subject of the sibling serializer advisories) — so the bypassed creation-time check was the only\n  layer that could have stopped it. Demonstrated for all four `create*` sites in\n  `poc_creation_strict_serialization_bypass.cjs`.\n\n## Fix Applied\n\n`createElementNS`, `createAttributeNS`, `createDocumentType`, and `createAttribute` now reject a name\ncontaining a line terminator with `InvalidCharacterError` — the same result they already give for\nother malformed names — because name validation now applies to the whole string. The\n`requireWellFormed` serializer's name checks are corrected by the same change. The fix is\nnon-breaking: such a name was already invalid, and no previously-accepted well-formed name is affected.","status":"published","published":"2026-09-08T21:02:33Z","modified":"2026-09-08T21:15:03.928359851Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-625","CWE-91"],"updated_at":"2026-11-02T15:46:36.092962Z"},{"id":"UBUNTU-CVE-2026-83609","description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose later text injects markup when serialized through either the default path or requireWellFormed: true. The triggering ECMAScript line terminators are U+000A, U+000D, U+2028, and U+2029. This issue is fixed in @xmldom/xmldom version 0.9.12.","status":"published","published":"2026-09-01T15:17:00Z","modified":"2026-10-17T13:01:12.153073243Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:22.213888Z"},{"id":"CLSA-2026-1790760268","title":"TuxCare security update for @xmldom/xmldom (4 CVEs)","description":"TuxCare rebuilt @xmldom/xmldom to address 4 CVEs. Fixed in 0.9.10-tuxcare.2.","status":"published","published":"2026-09-30T09:24:28Z","modified":"2026-10-15T09:47:57.301956488Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791987856","title":"TuxCare security update for @xmldom/xmldom (4 CVEs)","description":"TuxCare rebuilt @xmldom/xmldom to address 4 CVEs. Fixed in 0.9.8-tuxcare.5.","status":"published","published":"2026-10-14T14:24:16Z","modified":"2026-10-15T09:48:00.183619915Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1793108546","title":"TuxCare security update for @xmldom/xmldom (1 CVE)","description":"TuxCare rebuilt @xmldom/xmldom to address 1 CVE. Fixed in 0.7.13-tuxcare.3.","status":"published","published":"2026-10-27T13:42:26Z","modified":"2026-10-27T19:30:05.123414106Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"ROOT-APP-NPM-CVE-2026-83609","title":"CVE-2026-83609 in @xmldom/xmldom - Patched by Root","description":"Root has patched CVE-2026-83609 in the @xmldom/xmldom package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-16T07:51:17Z","modified":"2026-09-16T08:15:03.888470984Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}