{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-83607", "tracking": { "current_release_date": "2026-10-16T13:47:22.440791Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-83607", "initial_release_date": "2026-09-01T14:38:44.473049Z", "revision_history": [ { "date": "2026-09-01T14:38:44.473049Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (1).| Products created (2).| References created (7).| CWES updated (1)." }, { "date": "2026-09-01T14:38:53.300649Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-09-01T15:34:38.124658Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (7).| CWES updated (1)." }, { "date": "2026-09-01T15:34:40.448028Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-09-01T15:34:53.265474Z", "number": "5", "summary": "NCSC Score updated." }, { "date": "2026-09-01T16:39:27.770000Z", "number": "6", "summary": "Unknown change." }, { "date": "2026-09-02T00:28:29.153789Z", "number": "7", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (2).| Product Identifiers created (1).| References created (9).| CWES updated (1).| Vendor_assessment created." }, { "date": "2026-09-02T00:28:31.958212Z", "number": "8", "summary": "NCSC Score updated." }, { "date": "2026-09-02T02:03:41.098105Z", "number": "9", "summary": "Source created.| CVE status created. (valid)| Description created for source.| Products connected (1)." }, { "date": "2026-09-02T02:03:42.345709Z", "number": "10", "summary": "NCSC Score updated." }, { "date": "2026-09-02T07:13:36.408653Z", "number": "11", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (56).| References created (9).| CWES updated (1)." }, { "date": "2026-09-02T07:13:44.514634Z", "number": "12", "summary": "NCSC Score updated." }, { "date": "2026-09-03T06:38:38.540743Z", "number": "13", "summary": "Products removed (24)." }, { "date": "2026-09-03T06:38:44.713049Z", "number": "14", "summary": "NCSC Score updated." }, { "date": "2026-09-03T14:08:26.484283Z", "number": "15", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-07T07:56:18.079667Z", "number": "16", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-07T07:56:19.301914Z", "number": "17", "summary": "NCSC Score updated." }, { "date": "2026-09-07T12:22:59.418750Z", "number": "18", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| CWES updated (1)." }, { "date": "2026-09-08T20:06:00.687895Z", "number": "19", "summary": "Source connected.| CVE status created. (valid)| News created (1)." }, { "date": "2026-09-08T20:06:03.013666Z", "number": "20", "summary": "NCSC Score updated." }, { "date": "2026-09-09T06:40:08.704453Z", "number": "21", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (9).| CWES updated (1)." }, { "date": "2026-09-09T06:40:12.201675Z", "number": "22", "summary": "NCSC Score updated." }, { "date": "2026-09-09T12:22:03.473230Z", "number": "23", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-09T12:22:38.396379Z", "number": "24", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (3).| References created (8).| CWES updated (1)." }, { "date": "2026-09-09T12:22:41.193165Z", "number": "25", "summary": "NCSC Score updated." }, { "date": "2026-09-09T12:53:19.218114Z", "number": "26", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-09T12:53:35.890336Z", "number": "27", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-09T12:53:46.385656Z", "number": "28", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-09T12:53:47.694923Z", "number": "29", "summary": "NCSC Score updated." }, { "date": "2026-09-09T12:53:55.296445Z", "number": "30", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-09T12:54:14.484317Z", "number": "31", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-09T12:54:25.057564Z", "number": "32", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-09T15:17:17.207184Z", "number": "33", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-09T15:17:18.717275Z", "number": "34", "summary": "NCSC Score updated." }, { "date": "2026-09-22T00:38:57.963331Z", "number": "35", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (4).| Product Remediations created (6).| References created (47).| CWES updated (1)." }, { "date": "2026-09-22T00:39:03.543076Z", "number": "36", "summary": "NCSC Score updated." }, { "date": "2026-09-24T15:20:02.164122Z", "number": "37", "summary": "EPSS updated." }, { "date": "2026-09-24T15:20:06.757398Z", "number": "38", "summary": "NCSC Score updated." }, { "date": "2026-09-28T11:33:11.552385Z", "number": "39", "summary": "Source connected.| CVE status created. (valid)| Products connected (2).| References created (3)." }, { "date": "2026-09-28T11:33:17.173796Z", "number": "40", "summary": "NCSC Score updated." }, { "date": "2026-09-29T12:20:42.507921Z", "number": "41", "summary": "Source connected.| CVE status created. (valid)| Products connected (3).| References created (21)." }, { "date": "2026-09-29T12:50:59.602685Z", "number": "42", "summary": "NCSC Score updated." }, { "date": "2026-09-29T15:25:42.088556Z", "number": "43", "summary": "EPSS created.| Unknown change." }, { "date": "2026-10-05T11:29:55.672488Z", "number": "44", "summary": "Products connected (1).| References created (1)." }, { "date": "2026-10-05T11:30:04.190908Z", "number": "45", "summary": "NCSC Score updated." }, { "date": "2026-10-12T08:07:56.781915Z", "number": "46", "summary": "Products connected (1).| References created (1)." }, { "date": "2026-10-12T08:07:58.693566Z", "number": "47", "summary": "NCSC Score updated." }, { "date": "2026-10-12T08:30:20.203684Z", "number": "48", "summary": "Products created (24)." }, { "date": "2026-10-15T06:13:00.807706Z", "number": "49", "summary": "Products removed (24)." }, { "date": "2026-10-15T06:13:02.044373Z", "number": "50", "summary": "NCSC Score updated." }, { "date": "2026-10-16T06:19:43.050532Z", "number": "51", "summary": "Source connected.| CVE status created. (valid)" }, { "date": "2026-10-16T06:19:53.837521Z", "number": "52", "summary": "NCSC Score updated." }, { "date": "2026-10-16T12:22:25.187176Z", "number": "53", "summary": "Products connected (1).| References created (1)." }, { "date": "2026-10-16T12:23:13.625238Z", "number": "54", "summary": "NCSC Score updated." } ], "status": "interim", "version": "54" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0.7.0|<0.8.14", "product": { "name": "vers:unknown/>=0.7.0|<0.8.14", "product_id": "CSAFPID-9165617" } }, { "category": "product_version_range", "name": "vers:unknown/>=0.9.0|<0.9.11", "product": { "name": "vers:unknown/>=0.9.0|<0.9.11", "product_id": "CSAFPID-9165616" } } ], "category": "product_name", "name": "@xmldom/xmldom" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/0.1.0", "product": { "name": "vers:unknown/0.1.0", "product_id": "CSAFPID-8537894" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.1", "product": { "name": "vers:unknown/0.1.1", "product_id": "CSAFPID-8537895" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.17", "product": { "name": "vers:unknown/0.1.17", "product_id": "CSAFPID-8537896" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.18", "product": { "name": "vers:unknown/0.1.18", "product_id": "CSAFPID-8537897" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.19", "product": { "name": "vers:unknown/0.1.19", "product_id": "CSAFPID-8537898" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.2", "product": { "name": "vers:unknown/0.1.2", "product_id": "CSAFPID-8537899" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.20", "product": { "name": "vers:unknown/0.1.20", "product_id": "CSAFPID-8537900" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.21", "product": { "name": "vers:unknown/0.1.21", "product_id": "CSAFPID-8537901" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.22", "product": { "name": "vers:unknown/0.1.22", "product_id": "CSAFPID-8537902" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.23", "product": { "name": "vers:unknown/0.1.23", "product_id": "CSAFPID-8537903" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.24", "product": { "name": "vers:unknown/0.1.24", "product_id": "CSAFPID-8537904" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.25", "product": { "name": "vers:unknown/0.1.25", "product_id": "CSAFPID-8537905" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.26", "product": { "name": "vers:unknown/0.1.26", "product_id": "CSAFPID-8537906" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.27", "product": { "name": "vers:unknown/0.1.27", "product_id": "CSAFPID-8537907" } }, { "category": "product_version_range", "name": "vers:unknown/0.2.0", "product": { "name": "vers:unknown/0.2.0", "product_id": "CSAFPID-3441066" } }, { "category": "product_version_range", "name": "vers:unknown/0.2.1", "product": { "name": "vers:unknown/0.2.1", "product_id": "CSAFPID-3441067" } }, { "category": "product_version_range", "name": "vers:unknown/0.3.0", "product": { "name": "vers:unknown/0.3.0", "product_id": "CSAFPID-3441068" } }, { "category": "product_version_range", "name": "vers:unknown/0.4.0", "product": { "name": "vers:unknown/0.4.0", "product_id": "CSAFPID-3441069" } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0", "product": { "name": "vers:unknown/0.5.0", "product_id": "CSAFPID-3441070" } }, { "category": "product_version_range", "name": "vers:unknown/0.6.0", "product": { "name": "vers:unknown/0.6.0", "product_id": "CSAFPID-4349372" } }, { "category": "product_version_range", "name": "vers:unknown/0.7.0", "product": { "name": "vers:unknown/0.7.0", "product_id": "CSAFPID-3437183" } }, { "category": "product_version_range", "name": "vers:unknown/0.7.0+scoped", "product": { "name": "vers:unknown/0.7.0+scoped", "product_id": "CSAFPID-3437184" } }, { "category": "product_version_range", "name": "vers:unknown/0.7.0+unscoped", "product": { "name": "vers:unknown/0.7.0+unscoped", "product_id": "CSAFPID-3437185" } }, { "category": "product_version_range", "name": "vers:unknown/0.7.1", "product": { "name": "vers:unknown/0.7.1", "product_id": "CSAFPID-3437186" } }, { "category": "product_version_range", "name": "vers:unknown/0.7.2", "product": { "name": "vers:unknown/0.7.2", "product_id": "CSAFPID-3437187" } }, { "category": "product_version_range", "name": "vers:unknown/0.7.3", "product": { "name": "vers:unknown/0.7.3", "product_id": "CSAFPID-3437188" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.0", "product": { "name": "vers:unknown/0.8.0", "product_id": "CSAFPID-5037326" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.1", "product": { "name": "vers:unknown/0.8.1", "product_id": "CSAFPID-5037327" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.10", "product": { "name": "vers:unknown/0.8.10", "product_id": "CSAFPID-6245827" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.11", "product": { "name": "vers:unknown/0.8.11", "product_id": "CSAFPID-6245828" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.12", "product": { "name": "vers:unknown/0.8.12", "product_id": "CSAFPID-8740608" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.13", "product": { "name": "vers:unknown/0.8.13", "product_id": "CSAFPID-8932784" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.2", "product": { "name": "vers:unknown/0.8.2", "product_id": "CSAFPID-5037328" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.3", "product": { "name": "vers:unknown/0.8.3", "product_id": "CSAFPID-5037329" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.4", "product": { "name": "vers:unknown/0.8.4", "product_id": "CSAFPID-6245821" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.5", "product": { "name": "vers:unknown/0.8.5", "product_id": "CSAFPID-6245822" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.6", "product": { "name": "vers:unknown/0.8.6", "product_id": "CSAFPID-6245823" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.7", "product": { "name": "vers:unknown/0.8.7", "product_id": "CSAFPID-6245824" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.8", "product": { "name": "vers:unknown/0.8.8", "product_id": "CSAFPID-6245825" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.9", "product": { "name": "vers:unknown/0.8.9", "product_id": "CSAFPID-6245826" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.0", "product": { "name": "vers:unknown/0.9.0", "product_id": "CSAFPID-6245829" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.1", "product": { "name": "vers:unknown/0.9.1", "product_id": "CSAFPID-6245830" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.10", "product": { "name": "vers:unknown/0.9.10", "product_id": "CSAFPID-9104869" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.2", "product": { "name": "vers:unknown/0.9.2", "product_id": "CSAFPID-6245831" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.3", "product": { "name": "vers:unknown/0.9.3", "product_id": "CSAFPID-6245832" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.4", "product": { "name": "vers:unknown/0.9.4", "product_id": "CSAFPID-6245833" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.5", "product": { "name": "vers:unknown/0.9.5", "product_id": "CSAFPID-6245834" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.6", "product": { "name": "vers:unknown/0.9.6", "product_id": "CSAFPID-6245835" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.7", "product": { "name": "vers:unknown/0.9.7", "product_id": "CSAFPID-6245836" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.8", "product": { "name": "vers:unknown/0.9.8", "product_id": "CSAFPID-6245837" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.9", "product": { "name": "vers:unknown/0.9.9", "product_id": "CSAFPID-8740607" } }, { "category": "product_version_range", "name": "vers:unknown/<=0.6.0", "product": { "name": "vers:unknown/<=0.6.0", "product_id": "CSAFPID-2762020" } }, { "category": "product_version_range", "name": "vers:unknown/>=0|<=0.6.0", "product": { "name": "vers:unknown/>=0|<=0.6.0", "product_id": "CSAFPID-4972909" } }, { "category": "product_version_range", "name": "vers:unknown/v0.1.27", "product": { "name": "vers:unknown/v0.1.27", "product_id": "CSAFPID-3441072" } }, { "category": "product_version_range", "name": "vers:unknown/v0.1.28-not-published", "product": { "name": "vers:unknown/v0.1.28-not-published", "product_id": "CSAFPID-3441073" } }, { "category": "product_version_range", "name": "vers:unknown/v0.1.28-xmldom-alpha", "product": { "name": "vers:unknown/v0.1.28-xmldom-alpha", "product_id": "CSAFPID-3441074" } }, { "category": "product_version_range", "name": "vers:unknown/v0.7.0", "product": { "name": "vers:unknown/v0.7.0", "product_id": "CSAFPID-3437191" } }, { "category": "product_version_range", "name": "vers:unknown/xmldom-aplha@v0.1.28", "product": { "name": "vers:unknown/xmldom-aplha@v0.1.28", "product_id": "CSAFPID-3441075" } } ], "category": "product_name", "name": "xmldom" } ], "category": "vendor", "name": "xmldom" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<12.0.12.30", "product": { "name": "vers:unknown/<12.0.12.30", "product_id": "CSAFPID-9477920" } }, { "category": "product_version_range", "name": "vers:unknown/<13.0.9.0", "product": { "name": "vers:unknown/<13.0.9.0", "product_id": "CSAFPID-9477921" } } ], "category": "product_name", "name": "App Connect Enterprise" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<10.5.0.23", "product": { "name": "vers:unknown/<10.5.0.23", "product_id": "CSAFPID-9485661" } }, { "category": "product_version_range", "name": "vers:unknown/<10.6.0.11", "product": { "name": "vers:unknown/<10.6.0.11", "product_id": "CSAFPID-9485662" } }, { "category": "product_version_range", "name": "vers:unknown/<11.0.0.3", "product": { "name": "vers:unknown/<11.0.0.3", "product_id": "CSAFPID-9485663" } } ], "category": "product_name", "name": "DataPower Gateway" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/unknown", "product": { "name": "vers:unknown/unknown", "product_id": "CSAFPID-1337768", "product_identification_helper": { "cpe": "cpe:/a:ibm:business_automation_workflow:-" } } } ], "category": "product_name", "name": "IBM Business Automation Workflow" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/unknown", "product": { "name": "vers:unknown/unknown", "product_id": "CSAFPID-5211181", "product_identification_helper": { "cpe": "cpe:/a:ibm:websphere_service_registry_and_repository:-" } } } ], "category": "product_name", "name": "IBM WebSphere Service Registry and Repository" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/unknown", "product": { "name": "vers:unknown/unknown", "product_id": "CSAFPID-1317177", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "product_name", "name": "Oracle Linux" } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1.9", "product": { "name": "vers:rpm/1.9", "product_id": "CSAFPID-5760320", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhdh:1.9::el9" } } } ], "category": "product_name", "name": "Red Hat Developer Hub 1.9" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1789554285", "product": { "name": "vers:oci/1789554285", "product_id": "CSAFPID-9368042", "product_identification_helper": { "purl": "pkg:oci/rhdh-hub-rhel9@sha256%3Aea53db6012b6fe1c80760624caddb0d3b674614b62cb3c359ed3fde270314eb2?arch=amd64&repository_url=registry.redhat.io/rhdh/rhdh-hub-rhel9&tag=1789554285" } } } ], "category": "product_name", "name": "rhdh-hub-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1789558887", "product": { "name": "vers:oci/1789558887", "product_id": "CSAFPID-9368043", "product_identification_helper": { "purl": "pkg:oci/rhdh-operator-bundle@sha256%3A1b8153a28b5a3797104fd32a54e3ac38b3b573ff2d65d99bd257d650eddea1fc?arch=amd64&repository_url=registry.redhat.io/rhdh/rhdh-operator-bundle&tag=1789558887" } } } ], "category": "product_name", "name": "rhdh-operator-bundle" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1789552931", "product": { "name": "vers:oci/1789552931", "product_id": "CSAFPID-9368044", "product_identification_helper": { "purl": "pkg:oci/rhdh-rhel9-operator@sha256%3A036c292951ddf755006c6fefc9e1b8faf9a784757b91785e990bbfb856baa3ff?arch=amd64&repository_url=registry.redhat.io/rhdh/rhdh-rhel9-operator&tag=1789552931" } } } ], "category": "product_name", "name": "rhdh-rhel9-operator" } ], "category": "product_family", "name": "Red Hat Developer Hub" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/4", "product": { "name": "vers:rpm/4", "product_id": "CSAFPID-1439328", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4" } } } ], "category": "product_name", "name": "Red Hat OpenShift Container Platform 4" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1441120" } } ], "category": "product_name", "name": "ose-console" } ], "category": "product_family", "name": "Red Hat OpenShift Container Platform 4" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/unknown", "product": { "name": "vers:deb/unknown", "product_id": "CSAFPID-5991503" } } ], "category": "product_name", "name": "node-xmldom" } ], "category": "product_family", "name": "bookworm" } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0.7.0|<0.8.14", "product": { "name": "vers:unknown/>=0.7.0|<0.8.14", "product_id": "CSAFPID-9104840" } }, { "category": "product_version_range", "name": "vers:unknown/>=0.9.0|<0.9.11", "product": { "name": "vers:unknown/>=0.9.0|<0.9.11", "product_id": "CSAFPID-9104841" } } ], "category": "product_name", "name": "xmldom" } ], "category": "vendor", "name": "@xmldom" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-83607", "cwe": { "id": "CWE-91", "name": "XML Injection (aka Blind XPath Injection)" }, "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "CSAFPID-9368043", "CSAFPID-9368044" ] } ], "notes": [ { "category": "description", "text": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-controlled tag names could inject attributes, elements, or processing instructions into serialized XML or HTML and could cause cross-site scripting when browser-consumed. The unchecked values violate the XML QName constraint, and default serialization and creation-time createElement() behavior remain permissive. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.", "title": "osvgit - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-83607.json?alt=media" }, { "category": "description", "text": "## Summary\n\n`Document.createElement()` in `@xmldom/xmldom` accepts arbitrary strings as the `tagName` parameter with zero validation. The serializer emits the tag name verbatim into XML/HTML output. Critically, the `requireWellFormed: true` serializer option — the recommended mitigation from CVE-2026-41672, CVE-2026-41674, and CVE-2026-34601 — did NOT catch this, making it a bypass of the existing security controls.\n\nAn attacker who controls the element name string can inject arbitrary attributes (including event handlers) into the serialized output, leading to XSS when the output is consumed by a browser or downstream parser.\n\n## Details\n\n`Document.createElement()` accepts any string as `tagName` and stores it directly on the element node without validation. When the document is later serialized via `XMLSerializer.serializeToString()`, the serializer emits the `tagName` verbatim into the output.\n\nThe XML specification requires element names to conform to the `Name` production. The existing `createAttributeNS()` and `createElementNS()` methods validate qualified names against an anchored name/`QName` pattern, but `createElement()` bypasses this entirely, and the `requireWellFormed: true` serializer path performed no element-name validation — rendering it ineffective against this vector.\n\n### Root Cause\n\n1. `createElement()` stores the raw `tagName` string without any validation.\n2. The serializer's `requireWellFormed` code path did not validate element names against the XML `Name`/`QName` production.\n3. The serializer emits `tagName` directly into angle brackets: `<${tagName}...>`.\n\n## Proof of Concept\n\n```js\nconst { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');\n\nconst impl = new DOMImplementation();\nconst serializer = new XMLSerializer();\nconst doc = impl.createDocument(null, 'root', null);\n\n// Inject an element whose \"name\" contains attributes with an XSS payload\nconst el = doc.createElement('img src=x onerror=\"alert(1)\"');\ndoc.documentElement.appendChild(el);\n\nconst output = serializer.serializeToString(doc, { requireWellFormed: true });\nconsole.log(output);\n// \n//\n// A browser parsing this HTML will execute alert(1).\n// requireWellFormed: true did NOT prevent the injection.\n```\n\n## Impact\n\nApplications that use `@xmldom/xmldom` to construct DOM trees and serialize them to XML/HTML are vulnerable to injection attacks if any part of an element name originates from user input. This includes:\n\n- **Cross-Site Scripting (XSS)**: Injecting event handler attributes (`onerror`, `onclick`, etc.) into HTML output consumed by browsers.\n- **XML injection**: Breaking XML document structure by injecting closing tags, new elements, or processing instructions through the element name.\n- **Security control bypass**: Applications that adopted `requireWellFormed: true` as a mitigation for CVE-2026-41672 / 41674 / 34601 remained vulnerable through this vector.\n\n`@xmldom/xmldom` can also be used inside browsers, where it mirrors the DOM API. Unlike the browser's `createElement()`, which rejects an invalid name with `InvalidCharacterError`, xmldom accepts it — developers may assume the same safety and skip validation.\n\n## Fix Applied\n\n> **⚠ Opt-in required.** Protection is not automatic. Existing serialization calls remain\n> vulnerable unless `{ requireWellFormed: true }` is explicitly passed. Applications that\n> serialize untrusted DOM content should audit all `serializeToString()` call sites and add it.\n\nWhen `{ requireWellFormed: true }` is passed, the serializer now validates each element's serialized qualified name against the XML `QName` production and throws `InvalidStateError` before emitting the start tag. This also covers the **namespace-prefix** sub-vector: an invalid prefix surfaces either in the element qualified name (`PREFIX:local`) or in a synthesized `xmlns:PREFIX` declaration, and both are QName-checked.\n\nFixed under `requireWellFormed: true` in `@xmldom/xmldom` **0.9.11** and **0.8.14**. Default serialization is unchanged.\n\n### PoC — fixed path\n\n```js\nconst { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');\n\nconst doc = new DOMImplementation().createDocument(null, 'root', null);\ndoc.documentElement.appendChild(doc.createElement('img src=x onerror=\"alert(1)\"'));\n\n// Default (unchanged): verbatim — injection present\nconsole.log(new XMLSerializer().serializeToString(doc));\n// \n\n// Opt-in guard: throws InvalidStateError before serializing\ntry {\n new XMLSerializer().serializeToString(doc, { requireWellFormed: true });\n} catch (e) {\n console.log(e.name, e.message);\n // InvalidStateError: The element name \"img src=x onerror=\"alert(1)\"\" is not a valid XML QName\n}\n```\n\n### Why the default stays verbatim\n\nThe W3C DOM Parsing and Serialization spec defines a `require well-formed` flag whose **default value is `false`**. With the flag unset, the serializer emits element names verbatim, matching the `XMLSerializer` behavior of Chrome, Firefox, and Safari. Unconditionally throwing would be a behavioral breaking change with no spec justification; the opt-in `requireWellFormed: true` flag lets applications that require injection safety enable strict mode without breaking existing code.\n\n### Residual limitation\n\n`createElement(tagName)` does not validate `tagName` at creation time. Enforcing an `InvalidCharacterError` for invalid names unconditionally at creation time is a breaking change and is deferred to the next breaking release. When the default serialization path is used (without `requireWellFormed: true`), invalid element names are still emitted verbatim; applications that do not pass `requireWellFormed: true` remain exposed.\n\nCreation-time validation is tracked in a public issue on the next breaking-release milestone (filed at publication — issue link to be added), targeting the next breaking release.", "title": "osvnpm - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/npm%2FGHSA-w2rr-34g9-rvrj.json?alt=media" }, { "category": "description", "text": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-controlled tag names could inject attributes, elements, or processing instructions into serialized XML or HTML and could cause cross-site scripting when browser-consumed. The unchecked values violate the XML QName constraint, and default serialization and creation-time createElement() behavior remain permissive. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-83607" }, { "category": "description", "text": "A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. This vulnerability allows a remote attacker to inject malicious content, such as attributes or elements, into serialized XML or HTML documents. This occurs because the `Document.createElement()` function does not properly validate element names, and the `XMLSerializer.serializeToString()` function then outputs these unvalidated names directly. When these manipulated documents are processed by a web browser, it can lead to cross-site scripting (XSS), enabling attackers to execute arbitrary scripts in the user's browser.", "title": "redhat - https://access.redhat.com/security/cve/CVE-2026-83607" }, { "category": "description", "text": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-controlled tag names could inject attributes, elements, or processing instructions into serialized XML or HTML and could cause cross-site scripting when browser-consumed. The unchecked values violate the XML QName constraint, and default serialization and creation-time createElement() behavior remain permissive. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.", "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-83607" }, { "category": "description", "text": "xmldom: Element name injection via createElement() bypasses requireWellFormed", "title": "microsoft - https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Sep" }, { "category": "description", "text": "## Summary\n\n`Document.createElement()` in `@xmldom/xmldom` accepts arbitrary strings as the `tagName` parameter with zero validation. The serializer emits the tag name verbatim into XML/HTML output. Critically, the `requireWellFormed: true` serializer option — the recommended mitigation from CVE-2026-41672, CVE-2026-41674, and CVE-2026-34601 — did NOT catch this, making it a bypass of the existing security controls.\n\nAn attacker who controls the element name string can inject arbitrary attributes (including event handlers) into the serialized output, leading to XSS when the output is consumed by a browser or downstream parser.\n\n## Details\n\n`Document.createElement()` accepts any string as `tagName` and stores it directly on the element node without validation. When the document is later serialized via `XMLSerializer.serializeToString()`, the serializer emits the `tagName` verbatim into the output.\n\nThe XML specification requires element names to conform to the `Name` production. The existing `createAttributeNS()` and `createElementNS()` methods validate qualified names against an anchored name/`QName` pattern, but `createElement()` bypasses this entirely, and the `requireWellFormed: true` serializer path performed no element-name validation — rendering it ineffective against this vector.\n\n### Root Cause\n\n1. `createElement()` stores the raw `tagName` string without any validation.\n2. The serializer's `requireWellFormed` code path did not validate element names against the XML `Name`/`QName` production.\n3. The serializer emits `tagName` directly into angle brackets: `<${tagName}...>`.\n\n## Proof of Concept\n\n```js\nconst { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');\n\nconst impl = new DOMImplementation();\nconst serializer = new XMLSerializer();\nconst doc = impl.createDocument(null, 'root', null);\n\n// Inject an element whose \"name\" contains attributes with an XSS payload\nconst el = doc.createElement('img src=x onerror=\"alert(1)\"');\ndoc.documentElement.appendChild(el);\n\nconst output = serializer.serializeToString(doc, { requireWellFormed: true });\nconsole.log(output);\n// \n//\n// A browser parsing this HTML will execute alert(1).\n// requireWellFormed: true did NOT prevent the injection.\n```\n\n## Impact\n\nApplications that use `@xmldom/xmldom` to construct DOM trees and serialize them to XML/HTML are vulnerable to injection attacks if any part of an element name originates from user input. This includes:\n\n- **Cross-Site Scripting (XSS)**: Injecting event handler attributes (`onerror`, `onclick`, etc.) into HTML output consumed by browsers.\n- **XML injection**: Breaking XML document structure by injecting closing tags, new elements, or processing instructions through the element name.\n- **Security control bypass**: Applications that adopted `requireWellFormed: true` as a mitigation for CVE-2026-41672 / 41674 / 34601 remained vulnerable through this vector.\n\n`@xmldom/xmldom` can also be used inside browsers, where it mirrors the DOM API. Unlike the browser's `createElement()`, which rejects an invalid name with `InvalidCharacterError`, xmldom accepts it — developers may assume the same safety and skip validation.\n\n## Fix Applied\n\n> **⚠ Opt-in required.** Protection is not automatic. Existing serialization calls remain\n> vulnerable unless `{ requireWellFormed: true }` is explicitly passed. Applications that\n> serialize untrusted DOM content should audit all `serializeToString()` call sites and add it.\n\nWhen `{ requireWellFormed: true }` is passed, the serializer now validates each element's serialized qualified name against the XML `QName` production and throws `InvalidStateError` before emitting the start tag. This also covers the **namespace-prefix** sub-vector: an invalid prefix surfaces either in the element qualified name (`PREFIX:local`) or in a synthesized `xmlns:PREFIX` declaration, and both are QName-checked.\n\nFixed under `requireWellFormed: true` in `@xmldom/xmldom` **0.9.11** and **0.8.14**. Default serialization is unchanged.\n\n### PoC — fixed path\n\n```js\nconst { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');\n\nconst doc = new DOMImplementation().createDocument(null, 'root', null);\ndoc.documentElement.appendChild(doc.createElement('img src=x onerror=\"alert(1)\"'));\n\n// Default (unchanged): verbatim — injection present\nconsole.log(new XMLSerializer().serializeToString(doc));\n// \n\n// Opt-in guard: throws InvalidStateError before serializing\ntry {\n new XMLSerializer().serializeToString(doc, { requireWellFormed: true });\n} catch (e) {\n console.log(e.name, e.message);\n // InvalidStateError: The element name \"img src=x onerror=\"alert(1)\"\" is not a valid XML QName\n}\n```\n\n### Why the default stays verbatim\n\nThe W3C DOM Parsing and Serialization spec defines a `require well-formed` flag whose **default value is `false`**. With the flag unset, the serializer emits element names verbatim, matching the `XMLSerializer` behavior of Chrome, Firefox, and Safari. Unconditionally throwing would be a behavioral breaking change with no spec justification; the opt-in `requireWellFormed: true` flag lets applications that require injection safety enable strict mode without breaking existing code.\n\n### Residual limitation\n\n`createElement(tagName)` does not validate `tagName` at creation time. Enforcing an `InvalidCharacterError` for invalid names unconditionally at creation time is a breaking change and is deferred to the next breaking release. When the default serialization path is used (without `requireWellFormed: true`), invalid element names are still emitted verbatim; applications that do not pass `requireWellFormed: true` remain exposed.\n\nCreation-time validation is tracked in a public issue on the next breaking-release milestone (filed at publication — issue link to be added), targeting the next breaking release.", "title": "github - https://github.com/advisories/GHSA-w2rr-34g9-rvrj" }, { "category": "description", "text": "A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. This vulnerability allows a remote attacker to inject malicious content, such as attributes or elements, into serialized XML or HTML documents. This occurs because the `Document.createElement()` function does not properly validate element names, and the `XMLSerializer.serializeToString()` function then outputs these unvalidated names directly. When these manipulated documents are processed by a web browser, it can lead to cross-site scripting (XSS), enabling attackers to execute arbitrary scripts in the user's browser.", "title": "redhat - https://access.redhat.com/errata/RHSA-2026:69248" }, { "category": "description", "text": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-controlled tag names could inject attributes, elements, or processing instructions into serialized XML or HTML and could cause cross-site scripting when browser-consumed. The unchecked values violate the XML QName constraint, and default serialization and creation-time createElement() behavior remain permissive. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-83607" }, { "category": "other", "text": "0.00612", "title": "EPSS" }, { "category": "other", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" }, { "category": "other", "text": "8.7", "title": "CVSSV4 base score" }, { "category": "other", "text": "4.8", "title": "NCSC Score" }, { "category": "other", "text": "There is news data available from source Bleepingcomputer, There is product data available from source Certbundde, VENDOR FIX as product remediation category", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "The value of the most recent CVSS (V3) score, Is related to a product by vendor Debian, There is cwe data available from source Nvd", "title": "NCSC Score top decreasing factors" }, { "category": "details", "text": "Severity: 3\n", "title": "Vendor assessment" } ], "product_status": { "fixed": [ "CSAFPID-9368042" ], "known_affected": [ "CSAFPID-1439328", "CSAFPID-1441120", "CSAFPID-5991503", "CSAFPID-9104840", "CSAFPID-9104841", "CSAFPID-2762020", "CSAFPID-9477920", "CSAFPID-9477921", "CSAFPID-9485661", "CSAFPID-9485662", "CSAFPID-9485663", "CSAFPID-1337768", "CSAFPID-3437183", "CSAFPID-3437184", "CSAFPID-3437185", "CSAFPID-3437186", "CSAFPID-3437187", "CSAFPID-3437188", "CSAFPID-5037326", "CSAFPID-5037327", "CSAFPID-6245827", "CSAFPID-6245828", "CSAFPID-8740608", "CSAFPID-8932784", "CSAFPID-5037328", "CSAFPID-5037329", "CSAFPID-6245821", "CSAFPID-6245822", "CSAFPID-6245823", "CSAFPID-6245824", "CSAFPID-6245825", "CSAFPID-6245826", "CSAFPID-6245829", "CSAFPID-6245830", "CSAFPID-9104869", "CSAFPID-6245831", "CSAFPID-6245832", "CSAFPID-6245833", "CSAFPID-6245834", "CSAFPID-6245835", "CSAFPID-6245836", "CSAFPID-6245837", "CSAFPID-8740607", "CSAFPID-3437191", "CSAFPID-1317177", "CSAFPID-9165617", "CSAFPID-9165616", "CSAFPID-4972909", "CSAFPID-5211181" ], "known_not_affected": [ "CSAFPID-9368043", "CSAFPID-9368044" ] }, "references": [ { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-83607.json?alt=media" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-83607" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83607" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-83607" }, { "category": "external", "summary": "Source - debian", "url": "https://security-tracker.debian.org/tracker/CVE-2026-83607" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Source - microsoft", "url": "https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Sep" }, { "category": "external", "summary": "Source - bleepingcomputer", "url": "https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2026-patch-tuesday-fixes-966-flaws-2-zero-days/" }, { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-w2rr-34g9-rvrj" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:69248" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-83607" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3596.json" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3623.json" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/npm%2FGHSA-w2rr-34g9-rvrj.json?alt=media" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0431" }, { "category": "external", "summary": "News - bleepingcomputer", "url": "https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2026-patch-tuesday-fixes-966-flaws-2-zero-days/" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/xmldom/xmldom/pull/1043" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/xmldom/xmldom/pull/1050" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/xmldom/xmldom/releases/tag/0.8.14" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/xmldom/xmldom/releases/tag/0.9.11" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj" }, { "category": "external", "summary": "Reference - github; osv; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83607" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-83607" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-w2rr-34g9-rvrj" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:69248" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-19534" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-33818" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-54272" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-55553" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-56853" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-56858" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-56859" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-56860" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-56862" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-67214" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-67312" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-67422" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-69152" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-69192" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-73086" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-75899" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-75931" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-75975" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-76172" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-83605" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-83607" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-83608" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-83613" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-83614" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-83615" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-83616" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-83619" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-84292" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-84394" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-84961" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/updates/classification/" }, { "category": "external", "summary": "Reference - redhat", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526817" }, { "category": "external", "summary": "Reference - redhat", "url": "https://catalog.redhat.com/search?gs&searchType=containers&q=rhdh" }, { "category": "external", "summary": "Reference - redhat", "url": "https://developers.redhat.com/rhdh/overview" }, { "category": "external", "summary": "Reference - redhat", "url": "https://docs.redhat.com/en/documentation/red_hat_developer_hub" }, { "category": "external", "summary": "Reference - redhat", "url": "https://issues.redhat.com/browse/RHDHBUGS-3741" }, { "category": "external", "summary": "Reference - redhat", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69248.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "http://linux.oracle.com/errata/ELSA-2026-74085.html" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3596.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3596" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289740" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7290698" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7292706" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3623.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3623" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289775" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289776" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289778" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289779" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289780" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289783" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289785" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289787" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289788" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289789" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289790" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289791" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289792" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289794" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289795" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289796" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289797" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289798" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289800" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83607.json" } ], "remediations": [ { "category": "vendor_fix", "details": "For more about Red Hat Developer Hub, see References links", "product_ids": [ "CSAFPID-5760320", "CSAFPID-9368042" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:69248" }, { "category": "workaround", "details": "Sanitize or validate all untrusted element names before passing them to Document.createElement(), ensuring input strictly adheres to valid XML QName specifications prior to serialization.", "product_ids": [ "CSAFPID-5760320", "CSAFPID-9368042", "CSAFPID-9368043", "CSAFPID-9368044" ] } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1317177", "CSAFPID-1337768", "CSAFPID-1439328", "CSAFPID-1441120", "CSAFPID-2762020", "CSAFPID-3437183", "CSAFPID-3437184", "CSAFPID-3437185", "CSAFPID-3437186", "CSAFPID-3437187", "CSAFPID-3437188", "CSAFPID-3437191", "CSAFPID-4972909", "CSAFPID-5037326", "CSAFPID-5037327", "CSAFPID-5037328", "CSAFPID-5037329", "CSAFPID-5211181", "CSAFPID-5991503", "CSAFPID-6245821", "CSAFPID-6245822", "CSAFPID-6245823", "CSAFPID-6245824", "CSAFPID-6245825", "CSAFPID-6245826", "CSAFPID-6245827", "CSAFPID-6245828", "CSAFPID-6245829", "CSAFPID-6245830", "CSAFPID-6245831", "CSAFPID-6245832", "CSAFPID-6245833", "CSAFPID-6245834", "CSAFPID-6245835", "CSAFPID-6245836", "CSAFPID-6245837", "CSAFPID-8740607", "CSAFPID-8740608", "CSAFPID-8932784", "CSAFPID-9104840", "CSAFPID-9104841", "CSAFPID-9104869", "CSAFPID-9165616", "CSAFPID-9165617", "CSAFPID-9477920", "CSAFPID-9477921", "CSAFPID-9485661", "CSAFPID-9485662", "CSAFPID-9485663" ] } ], "title": "CVE-2026-83607" } ] }