{"vulnerability": "cve-2026-8361", "sightings": [{"uuid": "2b80fe70-9d85-4311-96ff-b0cb842d7bdb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8361", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mmupqwidc72z", "content": "\ud83d\udfe0 CVE-2026-8361 - High (7.5)\n\nA path traversal vulnerability exists in WOSDefaultHttpModule.dll when processing a URL path star...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-8361/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-28T00:01:25.141144Z"}, {"uuid": "74781b13-b1b4-45b3-a3dd-322fff39ec1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-8361", "type": "seen", "source": "https://www.acn.gov.it/portale/w/gladinet-disponibili-poc-per-nuove-vulnerabilita-in-triofox", "content": "", "creation_timestamp": "2026-05-28T04:18:30.000000Z"}, {"uuid": "94bc0b09-a294-4701-a026-e9310f613916", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-83619", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/63lwwxae36rgq", "content": "CVE-2026-83619 - xmldom: End-tag Whitespace-Trim Regex ReDoS \u2014 quadratic backtracking in the 0.8.x end-tag parser\nCVE ID : CVE-2026-83619\n \n Published : Sept. 1, 2026, 3:17 p.m. | 46\u00a0minutes ago\n \n Description : xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 C...", "creation_timestamp": "2026-09-01T16:42:23.350901Z"}, {"uuid": "3db5762f-d2c1-4765-9f5f-fa9f775a5961", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-83610", "type": "published-proof-of-concept", "source": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6", "content": "", "creation_timestamp": "2026-09-02T16:35:11.771826Z"}, {"uuid": "9b83bdde-4d81-4781-ae88-103e765dc5a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-83612", "type": "seen", "source": "https://gist.github.com/alon710/6001224d6aa2414b1f8b69a0a75f3dac", "content": "# CVE-2026-83612: CVE-2026-83612: Algorithmic Complexity and Denial of Service via Output Amplification in xmldom\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-83612\n\n## Summary\nA Denial of Service (DoS) vulnerability exists in the xmldom library when parsing HTML-mode documents with mixed-case closing tags for raw-text or escapable raw-text elements like script, style, textarea, or title. This leads to algorithmic complexity issues and quadratic output amplification during DOM serialization.\n\n## TL;DR\nUnauthenticated Denial of Service via quadratic output amplification triggered by parsing HTML with case-mismatched closing raw-text tags in xmldom.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-178 / CWE-400\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS Score**: 8.7\n- **EPSS Score**: 0.00301 (22.45th percentile)\n- **Impact**: Denial of Service (CPU & Memory exhaustion)\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js applications using @xmldom/xmldom for HTML parsing\n- Services processing untrusted XML/HTML documents via standard DOMParser in version range 0.9.0-beta.1 to 0.9.11\n- **@xmldom/xmldom**: >= 0.9.0-beta.1 < 0.9.12 (Fixed in: `0.9.12`)\n\n## Mitigation\n\n- Upgrade @xmldom/xmldom to version 0.9.12 or later.\n- Use package overrides to force dependencies to version 0.9.12.\n- Avoid parsing untrusted HTML documents with legacy versions of the parser.\n\n**Remediation Steps:**\n1. Verify vulnerability with npm ls @xmldom/xmldom.\n2. Execute npm install @xmldom/xmldom@0.9.12 to upgrade.\n3. Add overrides to package.json if it is a transitive dependency.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-6mj3-qw4j-hgrw)\n- [Official GitHub Fixing Commit](https://github.com/xmldom/xmldom/commit/7ced40c06c28d151e996a97045018c3559ae4707)\n- [Official Pull Request](https://github.com/xmldom/xmldom/pull/1071)\n- [Release Release Notes for v0.9.12](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n- [National Vulnerability Database (NVD) Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-83612)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-83612)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-83612) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-08T21:33:08.476376Z"}, {"uuid": "4f2ed9eb-dd57-41da-aa2e-af8300a92709", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-83616", "type": "published-proof-of-concept", "source": "https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv", "content": "", "creation_timestamp": "2026-09-08T22:35:10.197939Z"}, {"uuid": "8a4fb3d8-d4f0-45a2-8cb6-bf6eb81a770a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-83617", "type": "published-proof-of-concept", "source": "https://github.com/xmldom/xmldom/security/advisories/GHSA-jxjr-3g7g-3944", "content": "", "creation_timestamp": "2026-09-08T22:35:12.397598Z"}, {"uuid": "5a9fe420-c2f5-4bd0-a5e8-77fa982d2a07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-83618", "type": "published-proof-of-concept", "source": "https://github.com/xmldom/xmldom/security/advisories/GHSA-vr34-hp96-76pp", "content": "", "creation_timestamp": "2026-09-08T22:35:19.251049Z"}, {"uuid": "101fa40d-cd3e-489b-88c1-2bbe5a8a1bc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-83611", "type": "published-proof-of-concept", "source": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59", "content": "", "creation_timestamp": "2026-09-08T22:35:21.450675Z"}, {"uuid": "81b33f51-3289-4f64-bc99-ab97298ed874", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-83613", "type": "published-proof-of-concept", "source": "https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6", "content": "", "creation_timestamp": "2026-09-08T22:35:28.532933Z"}, {"uuid": "fe3aeec4-a166-4e8b-86a1-66b92e5e10d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-83619", "type": "published-proof-of-concept", "source": "https://github.com/xmldom/xmldom/security/advisories/GHSA-x4fp-j954-r2f4", "content": "", "creation_timestamp": "2026-09-08T22:35:30.716157Z"}, {"uuid": "9304fee9-55bf-42d3-b88a-7e3269b8d671", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-83615", "type": "published-proof-of-concept", "source": "https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g", "content": "", "creation_timestamp": "2026-09-08T22:35:32.910829Z"}, {"uuid": "1302951e-473d-4e79-82d8-c3c7af72f9c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-83614", "type": "published-proof-of-concept", "source": "https://github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9", "content": "", "creation_timestamp": "2026-09-08T22:35:35.380093Z"}, {"uuid": "3674100e-cc05-4c58-a8a8-c0b7127e621c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-83612", "type": "published-proof-of-concept", "source": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6mj3-qw4j-hgrw", "content": "", "creation_timestamp": "2026-09-08T22:35:37.697713Z"}]}