The vulnerable parser in the xmldom library silently accepts an end tag that is not well‑formed, such as </a\njunk>. This causes the parser to close the element and discard later content without reporting an error. The flaw allows crafted XML to be parsed as if it were valid, bypassing any well‑formedness checks that depend on strict XML syntax enforcement. Consequently, an attacker could supply malicious XML that is considered trustworthy by downstream code, leading to logic or injection problems. This weakness is identified as CWE‑1286.

The issue affects the @xmldom/xmldom package as well as the older xmldom module. Any version before 0.8.15 for the @xmldom package and before 0.9.12 is vulnerable. The same applies to xmldom 0.6.0 and earlier. No fix is available for the legacy xmldom package. The vulnerability is present in environments where the library is used to parse XML from external or untrusted sources.

The CVSS base score is 6.9, indicating a moderate impact. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not known to be actively exploited in the wild. Attackers could exploit the flaw by feeding a specially crafted XML document to an application that relies on xmldom’s parseFromString, thereby bypassing input validation. The risk is higher in systems that trust the output of the parser without additional validation, and lower in those that perform strict checks independently.