The vulnerability arises when xmldom parses a Document Type declaration whose name contains an invalid XML character. The library accepts a name containing the character ">" or whitespace, which terminates the <!DOCTYPE ...> declaration and injects arbitrary sibling markup that can contain malicious HTML or JavaScript. This flaw enables an attacker to supply crafted XML that injects execution code into the parsed DOM, potentially leading to cross‑site scripting attacks.

The susceptible library is the pure‐JavaScript XML DOM parser xmldom, distributed under the @xmldom:xmldom name. All versions of @xmldom/xmldom prior to 0.8.15 and prior to 0.9.12, as well as the legacy xmldom package version 0.6.0 and earlier, are affected. No patched release exists for the older xmldom package.

The CVSS score of 8.7 indicates a high severity flaw. EPSS is not available and the vulnerability is not listed in CISA KEV. The attacker must provide or control XML input that is parsed by xmldom. If untrusted XML is processed client‑side or server‑side, the attacker can construct a DocType name embedding disallowed characters, causing the library to emit a self‑terminating declaration and inject malicious payload directly into the DOM. The path to exploitation is straightforward and requires no special privileges beyond input control.