xmldom EUVD-2026-69225

Exploitation requires that the target application calls DOMParser.parseFromString() on attacker-controlled XML using an unpatched @xmldom/xmldom version (prior to 0.8.15 or 0.9.12) or any version of the legacy xmldom package, AND that the application uses parse success - absence of thrown errors or error callbacks - as a security gate for XML well-formedness. The bypass is only meaningful in this parse-before-trust pattern; applications that parse XML purely for storage, display, or transformation without a security gate are not meaningfully at risk. The vulnerability does not inject discarded content into the DOM and does not enable direct code execution. No authentication, non-default configuration, or special deployment mode is required; CVSS AV:N/AC:L/PR:N/UI:N confirms the parser behavior is reachable by any caller without preconditions.

The CVSS 4.0 score of 6.9 with VI:L accurately reflects the bounded integrity impact: the vulnerability enables bypass of a well-formedness gate but does not inject content or grant code execution. Real-world risk is strongly context-dependent. Applications that use xmldom solely for display or storage with no security gating face minimal exposure. Risk is elevated for applications that rely on a clean parse as proof of XML validity - SAML SSO processors, XML Digital Signature verifiers, API input sanitizers - where silent acceptance of malformed tags could allow an attacker to circumvent a security control. No EPSS data is available in the provided input; no KEV listing and no public POC exist, making opportunistic mass exploitation unlikely. The AV:N/AC:L/PR:N/UI:N CVSS vector is consistent with the description: any caller of parseFromString() on untrusted input is affected without special conditions. The legacy xmldom package has no fix path, meaning installations using that package remain permanently exposed absent a migration. The PR diffs confirm the fix is in sax.js and is surgical - output is byte-identical for well-formed input.

An attacker submits crafted XML to a Node.js SAML or XML-signature endpoint with a malformed closing tag such as </Signature IGNORED_JUNK>. The unpatched xmldom silently closes the element and discards the trailing content without raising an error, causing the application's parse-success check to pass and the document to be processed as well-formed. Downstream signature verification or authorization logic then operates on a DOM it incorrectly believes was validated, potentially allowing the attacker to circumvent the well-formedness gate that was intended to block malformed inputs.