The vulnerability lies in the xmldom library’s XML name validation. From version 0.9.0 up to (and excluding) 0.9.12, the internal regular expression that checks XML names is compiled with multiline matching enabled. This causes the start (^) and end ($) anchors to apply only to the first line of the string. As a result, a string that starts with a syntactically valid XML name but continues with a line terminator and additional characters is accepted. When such a malformed name is later serialized, the inserted line terminator creates a new line and the trailing characters are interpreted as part of the XML document, enabling the injection of arbitrary markup. This could compromise the integrity of data or trigger downstream code paths that treat the injected markup as legitimate, potentially exposing the application to further injection or execution attacks, consistent with CWE-625 (Improper Validation or Sanitization) and CWE-91 (XML Injection).

The affected product is the xmldom JavaScript library. Versions from 0.9.0 through 0.9.11 inclusive contain the vulnerable code path (createElementNS, createAttributeNS, createDocumentType, and createAttribute). The issue was fixed in version 0.9.12 and later releases.

The CVSS score is 8.7, indicating high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves code running in an environment that uses xmldom to build or serialize XML documents; a malicious input can be supplied via application data or configuration that ultimately forms part of an element or attribute name. Successful exploitation would allow injection of arbitrary XML content, which can then be used for downstream attacks or data corruption. As the vulnerability is tied to library calls rather than a publicly exposed network interface, it is more likely to be exploited by attackers who have local code execution or the ability to influence the application’s input sources.