A high-severity XML injection vulnerability in the xmldom library allows unauthenticated attackers to manipulate XML structure through malformed input, potentially compromising data integrity.

This vulnerability stems from the use of a permissive regular expression in the QName_exact validator, which utilizes the multiline flag incorrectly. This flaw allows an unauthenticated attacker to inject malicious markup into XML elements or attributes by including specific ECMAScript line terminators that bypass validation checks.

Successful exploitation of this vulnerability can lead to significant integrity issues within applications relying on xmldom for XML processing. By injecting arbitrary markup, an attacker may be able to alter the intended logic of XML documents, leading to unauthorized data modification or potential downstream processing errors. With a CVSS score of 8.7, this vulnerability represents a high risk to application security, especially in environments that parse untrusted XML input.

Immediate Action: Update the xmldom package to version 0.9.12 or higher to implement the corrected regular expression validation.

Proactive Monitoring: Monitor application logs for unexpected XML structure changes or input patterns containing newline characters (U+000A, U+000D, U+2028, or U+2029) in fields processed by xmldom.

Compensating Controls: Utilize a Web Application Firewall or input validation layer to sanitize input strings for prohibited line terminators before they reach the XML parsing component.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the high CVSS score and the ease of exploitation, organizations using xmldom must prioritize upgrading to version 0.9.12. Failure to patch leaves applications vulnerable to XML injection, which can be leveraged to compromise the integrity of parsed documents and the business processes that depend on them.