A high-severity XML injection vulnerability in the xmldom library permits unauthenticated attackers to manipulate XML structure, potentially leading to data integrity compromise.

The vulnerability is an XML injection flaw (CWE-91) located in the lib/dom.js file, where the Document.createProcessingInstruction function fails to validate input targets. This allows an unauthenticated attacker to inject malicious characters that break XML processing boundaries.

Successful exploitation allows an attacker to alter the structure of XML documents generated by the application, which may lead to unauthorized data modification or downstream application logic errors. With a CVSS score of 8.7, this vulnerability poses a significant risk to the integrity of systems relying on xmldom for secure XML parsing and serialization.

Immediate Action: Update the @xmldom/xmldom dependency to version 0.8.15 or 0.9.12 immediately. If using the legacy xmldom package, which lacks a fix, consider migrating to the @xmldom/xmldom fork or implementing strict input sanitization as a temporary measure.

Proactive Monitoring: Review application logs for unusual XML structures or unexpected characters appearing in fields processed by XML serializers. Monitor for application errors that occur during the generation of XML output.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect XML payloads for suspicious sequences or invalid processing instructions. Ensure that input validation is enforced at the application layer to block unexpected characters before they reach the DOM parser.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for XML injection, organizations must prioritize updating the affected libraries. Because legacy versions of the xmldom package are not being patched, migration to the maintained @xmldom/xmldom fork is the only definitive path to remediation. Failure to address this flaw leaves systems exposed to structural manipulation of critical data.