A high-severity XML injection vulnerability in the xmldom library allows unauthenticated attackers to bypass security controls and inject malicious markup into serialized XML documents.

The vulnerability stems from the use of overly permissive regular expressions in the serializer, which fail to properly sanitize input when the multiline flag is inherited. This allows an unauthenticated attacker to inject breakout markup into the DOCTYPE declaration, successfully bypassing previous security mitigations.

The ability to inject arbitrary markup into XML documents poses a significant risk to data integrity and downstream system security. Successful exploitation could lead to secondary vulnerabilities in applications consuming the malformed XML, potentially resulting in unauthorized data access or disruption of business-critical XML-based workflows. With a CVSS score of 8.7, this vulnerability represents a high risk to the availability and integrity of affected systems.

Immediate Action: Update the xmldom library to version 0.9.12 or higher to resolve the regular expression validation flaw.

Proactive Monitoring: Review application logs for unexpected characters or structural anomalies within generated XML documents, particularly those involving public or system identifiers.

Compensating Controls: Implement strict input validation and schema enforcement at the application layer to ensure that serialized XML content adheres to expected formats regardless of the underlying library performance.

Public Exploit Available: Unknown

Given the high CVSS score and the nature of the flaw as a bypass of existing security controls, immediate remediation is required. Organizations utilizing the xmldom library must verify their current version and upgrade to 0.9.12 immediately to eliminate the injection vector. Continued reliance on unpatched versions significantly increases the risk of successful exploitation by adversaries seeking to manipulate XML-based data processing.