CyberRota Analysis
AI-GeneratedThe xmldom module in JavaScript is vulnerable to XML injection due to improper validation of the DocumentType.name property, allowing attackers to manipulate the <!DOCTYPE ...> declaration and potentially inject malicious markup. This vulnerability affects versions prior to 0.8.15 and 0.9.12 of @xmldom/xmldom, as well as xmldom version 0.6.0 and earlier, making it critical for developers using these versions to prioritize updates to mitigate the risk of exploitation. Organizations relying on JavaScript for XML processing should assess their usage of affected versions and implement the necessary patches immediately.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENT_TYPE_NODE branch in lib/dom.js validates publicId, systemId, and internalSubset under requireWellFormed: true but emits DocumentType.name verbatim. A name containing > or whitespace can terminate the <!DOCTYPE ...> declaration and inject sibling markup; the value can be supplied through createDocumentType() on the 0.8.x and unscoped lines or through a direct DocumentType.name property write on every affected line. The default path and legacy creation-time behavior remain permissive, while the vulnerable strict path fails to enforce an XML Name. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.