The vulnerability allows an attacker to create element and attribute names that include embedded line terminators, bypassing the required well‑formedness checks. Because the names are then emitted verbatim during serialization, an attacker can inject arbitrary tags or attributes into the parsed XML, potentially leading to code execution or malicious DOM manipulation. The weakness is a form of injection flaw identified as CWE‑625 and CWE‑91.

The issue affects the JavaScript library @xmldom:xmldom, specifically all releases from 0.9.11 up to but not including 0.9.12. The problem has been resolved in version 0.9.12 and later.

This flaw has a CVSS score of 8.7, indicating high severity. The EPSS score is not publicly available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require an application to parse untrusted XML using the affected xmldom parser. An attacker can supply crafted XML that embeds line terminator characters within element or attribute names, causing the parser to emit those names verbatim and enabling injection of arbitrary tags or attributes into the resulting document. The likelihood of exploitation depends on the exposure of xmldom to external input, but the high CVSS and lack of mitigation in earlier versions raise significant risk.