The vulnerability resides in the XML serializer of the xmldom library. Versions prior to 0.9.10, 0.8.13, and 0.6.0 allow comment content that an attacker controls to be serialized without any validation or neutralization of comment‑breaking sequences. If a comment contains a closing marker, the serializer ends the comment prematurely and the following characters are treated as normal XML nodes. This flaw is a form of code injection encoded as XML, classified as CWE‑91.

All releases of the xmldom package older than 0.9.10, older than 0.8.13, and 0.6.0 or earlier are affected. Any project importing one of those versions directly or through a transitive dependency is at risk.

The CVSS score of 8.7 reflects a high severity vulnerability. An attacker only needs to supply an XML document containing a crafted comment; no special configuration or elevated privileges are required. Because the injection occurs during serialization, downstream components that consume the produced XML may receive the attacker‑supplied nodes. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog.