xmldom EUVD-2026-69241

Exploitation requires two specific conditions to be simultaneously true: (1) the application must invoke XMLSerializer.serializeToString() with the explicit option { requireWellFormed: true } - this is a non-default setting that developers opt into specifically to enforce strict XML name validation; and (2) the attacker must control an element name, attribute name, or the node passed to serialization - for example, via a user-supplied XML document parsed by DOMParser that is later re-serialized, or via an API that allows clients to set node names. The default serialization path (without requireWellFormed) carries no strict name guarantee and was already outside the injection protection scope. Exploitation is limited to Node.js server-side environments where xmldom is installed; browser-native XML APIs are unaffected. Authentication requirements depend entirely on the host application; the CVSS PR:N vector indicates no library-level privilege requirement, but most realistic deployments will require at least an HTTP session to reach the affected code path.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H) reflects network-reachable, unauthenticated, high-integrity-impact exploitation, which is accurate for the worst-case deployment. However, exploitation is gated on a non-default configuration: the attacker must reach code that invokes XMLSerializer.serializeToString() with the requireWellFormed: true option AND accepts attacker-controlled node names - a narrower attack surface than the raw score implies. Applications using the default serialization path are outside the strict guarantee but also outside this specific bypass. EPSS data was not provided in the intelligence set; KEV status is negative, and no public proof-of-concept has been identified, so real-world exploitation has not been observed at time of analysis. The vulnerability class (injection bypass in a widely-used npm library) carries meaningful downstream risk because xmldom is frequently used as a dependency in XML-processing pipelines that may pass attacker-controlled content. The integrity signal is high and credible; the practical priority is somewhat moderated by the requireWellFormed condition, but teams relying on that flag for security guarantees should treat this as urgent.

An attacker submits a crafted XML document or API payload whose element name is encoded as foo\nbar><inject/>, where \n is a literal line feed. When the consuming application builds a DOM node with this name and serializes it via XMLSerializer.serializeToString({ requireWellFormed: true }), the multiline-anchored QName regex matches foo on the first line and accepts the name as valid; the serialized output includes the injected markup bar><inject/> verbatim, corrupting any downstream system that re-parses the document. No public proof-of-concept code has been identified, but the bypass technique is straightforward to reproduce from the advisory description.