The vulnerability is caused by Document.createProcessingInstruction accepting an unvalidated target string. An attacker can craft a target containing characters such as >, ?, or whitespace that break the <?target data?> boundary, allowing arbitrary XML structure to be injected into the processed document. Because the requireWellFormed serializer checks only for a colon and the case‑insensitive xml name on some releases and performs no target check on others, the injected XML can alter document semantics or introduce malicious content when the XML is later consumed.

The affected component is the xmldom JavaScript library. Versions prior to 0.8.15 and 0.9.12, and all 0.6.0 and earlier releases of xmldom, fail to validate the processing instruction target. No fix exists for the older xmldom package; the patch is only available in the @xmldom/xmldom releases 0.8.15 and 0.9.12.

The CVSS score of 8.7 indicates high severity, but the EPSS score is not available and the vulnerability is not listed in CISA KEV. Exploitation requires an application that uses xmldom to create a processing instruction and the ability to supply an arbitrary target string. In many web or Node.js contexts this could be achieved through user input or data files, enabling the injection of malicious XML before the document is used by downstream components.