CyberRota Analysis
AI-GeneratedThe xmldom module in JavaScript versions 0.9.10 to 0.9.12 is vulnerable to a DocumentType injection attack due to improper validation of the publicId and systemId fields, allowing attackers to inject malicious markup into the <!DOCTYPE ...> declaration. This vulnerability can lead to potential security breaches, including XSS attacks, and should be prioritized by developers and organizations using affected versions of the xmldom library to ensure their applications remain secure. Users are advised to upgrade to version 0.9.12 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with PubidLiteral_match and SystemLiteral_match expressions produced by reg() in lib/grammar.js, which inherit the multiline flag. A complete valid literal on the first line can therefore satisfy the matcher while U+000A, U+000D, U+2028, or U+2029 and breakout markup remain in the emitted <!DOCTYPE ...> declaration. This bypasses the strict-serialization mitigation for the earlier DocumentType injection advisory; creation and direct property assignment remain unvalidated by design. This issue is fixed in @xmldom/xmldom version 0.9.12.