xmldom, a pure JavaScript implementation of the W3C XML DOM Level 2 Core, contains a flaw in its CDATASection handling. The XMLSerializer fails to escape or split an attacker‑controlled `]]>` terminator inserted into a CDATA section, writing the terminator verbatim and turning the intended text into active XML markup. This permits arbitrary XML structure injection, allowing an attacker to manipulate the serialized document and potentially alter application logic or data transported in the XML.

The vulnerability affects the xmldom package named xmldom:xmldom. Versions 0.6.0 and older are susceptible, as are the @xmldom/xmldom releases prior to 0.8.12 and 0.9.9. Users of these libraries in Node.js or browser environments that serialize XML content with XMLSerializer must verify whether their code relies on CDATA sections containing user data and upgrade to the patched releases.

The advisory lists a CVSS score of 7.5, indicating a high risk and moderate to high impact. EPSS data is not reported and the vulnerability is not in the CISA KEV catalogue, suggesting it is not yet widely attacked. Based on the description, it is inferred that an attacker who can influence the XML content serialized by xmldom can insert a CDATA terminator and thereby cause arbitrary XML markup to be emitted. The likely attack vector is remote if the application accepts untrusted input for serialization, but the exact conditions depend on how the library is used. Successful exploitation could lead to unauthorized manipulation of XML structure and downstream application logic.