A high-severity XML injection vulnerability in the xmldom library allows unauthenticated attackers to inject malicious attributes, potentially leading to cross-site scripting or data manipulation.

This vulnerability is an XML injection flaw (CWE-91) where the Element.setAttribute function fails to validate attribute names. An unauthenticated attacker can provide crafted input to terminate intended attributes and inject unauthorized content, such as event handlers, which are then processed by the XMLSerializer.

The vulnerability carries a CVSS score of 8.7, indicating a significant risk to application integrity. Successful exploitation allows an attacker to manipulate the structure of XML documents, which can lead to unauthorized script execution in a user browser, data exfiltration, or the subversion of application logic. This presents a critical risk to web applications relying on xmldom for secure data parsing.

Immediate Action: Upgrade to @xmldom/xmldom version 0.8.14 or 0.9.11 immediately. Users of the legacy xmldom package should migrate to the maintained @xmldom/xmldom package, as no fix is available for the original version.

Proactive Monitoring: Inspect application logs for unusual XML input patterns, particularly those containing unexpected characters or attribute declarations that deviate from established schemas.

Compensating Controls: Implement strict input validation or sanitization layers before passing data to the xmldom parser to ensure that attribute names conform to expected standards.

Public Exploit Available: Unknown

Given the high CVSS score and the nature of XML injection, this vulnerability poses a severe threat to applications that process user-supplied XML. Organizations must prioritize updating to the patched versions of @xmldom/xmldom immediately. If an update is not immediately feasible, robust input validation must be enforced as a temporary defensive measure to prevent the injection of malicious attributes.