AIKIDO-2026-784472

TL;DR

Element.setAttribute() creates attribute nodes through a private helper that performs no validation, unlike the public createAttribute() which rejects invalid names. The serializer escapes attribute values but writes attribute names verbatim, so a name containing quote and space characters can terminate one attribute and inject additional attributes into the output. The requireWellFormed serialization option did not check attribute names, leaving applications that used it as a mitigation exposed to injected event handlers and overridden security attributes. The fix makes the requireWellFormed serializer validate each serialized attribute's qualified name and throw before emitting it.