A high-severity XML injection vulnerability in the xmldom library allows unauthenticated attackers to bypass security checks and manipulate XML structures.

The vulnerability stems from an overly permissive regular expression in the library's grammar check that fails to properly sanitize input containing specific newline characters. This flaw allows an unauthenticated attacker to inject malicious XML content that is emitted verbatim, effectively bypassing previous strict-serialization protections.

Successful exploitation of this vulnerability can lead to significant integrity risks, as attackers can inject arbitrary markup into XML documents. This could result in application logic bypass, data corruption, or the potential for downstream vulnerabilities in systems that process the tainted XML output. With a CVSS score of 8.7, this issue represents a high risk to application stability and security posture.

Immediate Action: Update the xmldom or @xmldom/xmldom library to version 0.9.12 or later immediately to incorporate the fix for the regex validation flaw.

Proactive Monitoring: Review application logs for unexpected XML structures or injection patterns in inputs processed by the xmldom library.

Compensating Controls: Implement strict input validation and sanitization at the application layer to block characters such as U+000A, U+000D, U+2028, and U+2029 in identifiers before they reach the XML parser.

Public Exploit Available: Unknown

Given the potential for XML injection and the existence of a proof-of-concept, organizations using the affected versions of xmldom must prioritize upgrading to version 0.9.12. Failure to patch allows for a trivial bypass of integrity checks, which could be leveraged to compromise downstream data processing workflows.