Technical impact
The vulnerability arises because xmldom's XMLSerializer writes DocumentType node fields verbatim without escaping or validation. This allows attacker‑controlled strings to terminate the DOCTYPE declaration early and inject arbitrary markup outside it. The result can violate data integrity by supplying unexpected XML content during generation or consumption by downstream parsers. The flaw constitutes a high‑severity XML injection issue with a CVSS score of 8.7.
Affected Systems
The library is xmldom, a pure JavaScript XML DOM implementation. Vulnerable releases are any version before 0.9.10, before 0.8.13, and all releases up to and including 0.6.0. The problem exists in the XMLSerializer component that outputs XML strings.
Risk and Exploitability
According to the CVSS rating, the exploit could have a high impact on integrity. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog, indicating no known widespread exploitation at the time of analysis. The likely attack vector involves creating or manipulating a DocumentType node in the DOM before serialization; the user would need to supply data that controls the internalSubset, publicId or systemId fields. Because the vulnerability stems from unescaped serialization, any application that constructs DocumentType nodes from untrusted data and subsequently serializes can be affected.
Github GHSA