The xmldom library, a pure JavaScript implementation of the W3C XML DOM Level 2 Core, failed to enforce strict well‑formedness checks on the DocumentType publicId and systemId fields between releases 0.9.10 and 0.9.12. It used multiline‑enabled regular expression literals, allowing an attacker to embed line terminators such as U+000A, U+000D, U+2028, or U+2029 into a publicId or systemId that passes the matcher yet still contains additional markup. This bypass enables a serialized <!DOCTYPE …> declaration to contain injected markup that can be interpreted by downstream consumers, potentially leading to DOM injection, cross‑site scripting, or other code execution attacks. The flaw is an example of improper input validation (CWE‑91) and an uncontrolled use of user input in serialization (CWE‑625).

Any deployment relying on the xmldom npm package, specifically those using versions 0.9.10 or 0.9.11 (i.e., any release preceding 0.9.12). Users who upgraded to a version later than 0.9.12 are not affected by the described flaw.

The CVSS score is 8.7, indicating a high‑severity vulnerability. EPSS is currently unavailable, so the likelihood of exploitation is uncertain, but the absence of a KEV listing suggests no confirmed widespread exploitation as of now. The flaw is exploitable when an attacker can control or influence the XML input that is serialized, for example through an API that accepts user‑supplied XML. The attack vector is likely local or remote depending on how the xmldom instance is used, and the vulnerability requires the impacted library to perform serialization—an operation generally available to application developers or services ingesting XML. The validator’s misuse of multiline regexes constitutes a type of improper input validation (CWE‑91) that permits injection of malicious markup.