AIKIDO-2026-814651
@xmldom/xmldom is vulnerable to XML Injection
87
High Risk
This Affects:
@xmldom/xmldomTL;DR
Document.createElement() accepts arbitrary element name strings without validating them against the XML QName production, and the serializer emits the stored name verbatim into its output. Because element names built from user-controlled input are written between angle brackets, they can carry extra attributes such as event handlers and break the intended markup structure. The requireWellFormed serialization option did not check element names, so applications relying on it as a hardening control stayed exposed and output consumed by a browser can execute injected script. The fix makes the requireWellFormed serializer validate each element's qualified name and throw before emitting an invalid start tag.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you serialize DOM trees whose element names are built from user-controlled input, including when you rely on the requireWellFormed: true option to reject invalid names.
Background info
@xmldom/xmldom is vulnerable to XML Injection in versions 0.9.0 - 0.9.10 and 0.7.0 - 0.8.13.
How to fix this
Upgrade the @xmldom/xmldom library to the patch version and pass { requireWellFormed: true } to serializeToString().
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant