CVE-2026-83618

high Red Hat
CVSS v3 Base Score
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Confidentiality
None
Integrity
High
Availability
None
Published: September 1, 2026 (5 days ago)
Last Modified: September 1, 2026
Vendor: Red Hat
Source: REDHAT

Description

A flaw was found in xmldom, a JavaScript XML parser and serializer module. A remote attacker could bypass the `requireWellFormed` strict-serialization mitigation for DocumentType injection by embedding line terminators within the `publicId` or `systemId` of a DocumentType declaration. This allows for the injection of arbitrary markup into the XML output, potentially leading to data manipulation or other security impacts depending on how the XML is processed.

CWE

CWE-91

Affected Products

Red Hat OpenShift Container Platform 4

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov 🔗 github.com 🔗 github.com