The vulnerability lies in the Element.setAttribute() method of xmldom, which calls an unvalidated internal path, allowing a crafted attribute name to terminate the intended attribute and inject additional attributes, including event handlers, into serialized XML. When this XML is consumed by a browser, the injected attributes can execute unintended code, resulting in XSS or other DOM‑level attacks. The flaw is a classic Attribute Injection weakness (CWE‑91) and a stored Cross‑Site Scripting vector (CWE‑79).

Vendors: @xmldom/xmldom and xmldom; product: xmldom. Affected versions are all releases prior to 0.8.14 and 0.9.11 of @xmldom/xmldom, and xmldom 0.6.0 and earlier. Any installation using these versions that retrieves XML via xmldom and subsequently renders it in a browser is at risk.

The CVSS score of 8.7 indicates high severity, and while EPSS data is not available, the issue is not yet listed in the CISA KEV catalog. Exploitation requires that the serialized XML be delivered to a browser context; the attacker must craft XML that, when parsed by xmldom, produces malicious attributes. Because the requireWellFormed flag does not enforce attribute name validation, detection is non‑trivial, making an attacker’s job easier. A successful injection directly yields cross‑site scripting through event handlers or other injected attributes.