An unauthenticated XML injection vulnerability in the xmldom library permits remote attackers to execute cross-site scripting attacks by injecting malicious XML structures.

This is an XML injection vulnerability (CWE-91) where the library fails to validate element names during creation or serialization. Because this occurs in a library used for DOM parsing, an unauthenticated attacker can inject arbitrary elements or attributes into the resulting XML output, which, if rendered in a web browser, leads to cross-site scripting.

Successful exploitation allows for cross-site scripting, which can lead to the theft of session cookies, sensitive user data, or unauthorized actions performed on behalf of legitimate users. With a CVSS score of 8.7, this flaw represents a high-severity risk that could compromise the integrity and confidentiality of web applications relying on this parser.

Immediate Action: Update the @xmldom/xmldom package to versions 0.8.14 or 0.9.11 immediately. Users of the legacy xmldom package should migrate to the maintained @xmldom/xmldom scope as no fix is available for the older branch.

Proactive Monitoring: Monitor web application logs for unusual XML input patterns or characters that deviate from standard expected schemas. Review client-side error consoles for potential injection attempts that might trigger script execution.

Compensating Controls: Implement a strict Content Security Policy (CSP) to mitigate the impact of potential cross-site scripting attacks. Ensure that any output generated by xmldom is sanitized before being rendered in a browser context.

Public Exploit Available: Unknown.

Given the high CVSS score and the prevalence of XML processing in modern web applications, the risk of exploitation is significant. Organizations should prioritize updating to the patched versions of @xmldom/xmldom immediately. If an update is not immediately feasible, rigorous input validation and the application of robust CSP headers are required to prevent the exploitation of this injection flaw.