XML injection in xmldom - #VU126511

Detailed vulnerability description

The vulnerability allows a remote attacker to inject arbitrary XML nodes into serialized output.

The vulnerability exists due to improper neutralization of special elements in processing instruction serialization in createProcessingInstruction and the XML serializer when serializing processing instruction data containing the PI-closing sequence. A remote attacker can supply specially crafted processing instruction data to inject arbitrary XML nodes into serialized output.

The issue affects the DOM construction and serialization flow for processing instruction nodes, where attacker-controlled data containing ?> can terminate the processing instruction early and be treated as active XML markup by downstream parsers.

Remediation

Sources

• https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx
• https://github.com/advisories/GHSA-x6wf-f3px-wcqx