Improper output neutralization in Qt’s QDom comment, CDATA, and processing‑instruction serialization allows the injection of arbitrary XML markup when untrusted text is serialized into these nodes. The default policy accepts invalid characters, so node terminators are not escaped, enabling attackers to alter the XML structure or embed malicious data. This flaw can be used to bypass application logic that relies on the XML structure, potentially leading to downstream injection attacks or data tampering.

Qt Qt 4.0.0 through 6.11 is affected. Every build in this range that uses QDom to serialize comment, CDATA or processing‑instruction nodes without custom validation is vulnerable. The vulnerability is present in the Qt XML module and persists across all platforms supported by the Qt library.

Based on the description, it is inferred that attackers can exploit this flaw by supplying untrusted XML input to an application that constructs QDom nodes; if the application treats the resulting XML as trustable data, the injected markup may influence downstream processing, potentially enabling broader compromise. The CVSS score of 2.9 indicates low severity. The EPSS score is less than 1 %, suggesting a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The risk lies primarily in data integrity and confidentiality of the application’s XML processing.