xmldom vulnerabilities

Vulnerability in @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and earlier. The package serializes DocumentType fields (internalSubset, publicId, systemId) without proper escaping, which can lead to premature termination of the DOCTYPE declaration and injection of arbitrary markup.

The vulnerability in the xmldom library allows an attacker to inject arbitrary XML nodes into serialized output via controlled comment content. Lack of validation of comment-breaking sequences enables premature comment termination and insertion of malicious XML code.

In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to 0.8.12 and 0.9.9, an attacker can insert a string containing the CDATA terminator ]]> into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator, enabling XML structure injection and downstream business-logic manipulation. The issue is patched in xmldom 0.6.0 and @xmldom/xmldom 0.8.12 and 0.9.9.