A high-severity XML injection vulnerability in the xmldom library permits unauthenticated attackers to manipulate document structures, posing a risk of data integrity compromise.

This is an XML injection flaw (CWE-91) where the library fails to enforce XML name constraints on the DocumentType.name property. An unauthenticated attacker can supply crafted input containing whitespace or angle brackets to terminate the DOCTYPE declaration prematurely and inject malicious sibling markup.

Successful exploitation allows an attacker to alter the structure of processed XML documents, which can lead to significant data integrity issues. Given the CVSS score of 8.7, this vulnerability is categorized as high risk, as it permits unauthorized modification of data without requiring any user interaction or prior authentication.

Immediate Action: Update the @xmldom/xmldom package to version 0.8.15 or 0.9.12 immediately. If using the legacy xmldom package, which lacks a fix, you must migrate to the @xmldom/xmldom scoped package or implement custom input validation to sanitize DOCTYPE names.

Proactive Monitoring: Review application logs for unexpected characters or structural anomalies within XML parsing routines. Monitor for service requests that involve unusual DOCTYPE declarations.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block inbound requests containing suspicious XML entity or DOCTYPE definitions.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

This vulnerability presents a clear risk to data integrity within applications relying on the xmldom library. Organizations should prioritize updating to the patched versions provided by the vendor. For legacy implementations where no patch exists, immediate migration is required to ensure the security of the application stack.