Executive brief
xmldom is a popular JavaScript library for parsing and serializing XML documents. The library's processing instruction serialization does not adequately validate target names, allowing an attacker who can control the target string to break out of the XML processing instruction syntax and inject arbitrary XML content. This could enable cross-site scripting (XSS) attacks if the output is served as XHTML or processed by a browser-based XML parser.
Technical details
The vulnerability exists in the Document.createProcessingInstruction(target, data) function, which accepts any string as the target parameter without validation. During XML serialization, processing instructions are formatted as "<?target data?>". The incomplete requireWellFormed validation in the serializer only checks for colons and the reserved "xml" prefix but fails to validate against the full XML Name production, critically missing characters like ">", "?", and whitespace that break PI syntax. An attacker can inject a ">" character in the target to prematurely close the PI boundary, allowing injection of arbitrary XML elements, text content, or additional processing instructions. When serialized with requireWellFormed:true (opt-in), this now throws InvalidStateError per the fix, but the default serialization path remains vulnerable. The vulnerability requires the attacker to control the target string passed to createProcessingInstruction() and have the serialized output consumed by a downstream XML parser or browser.
Affected products
- xmldom @xmldom/xmldom 0.7.0 through 0.8.14, 0.9.0 through 0.9.11
- xmldom xmldom 0.6.0 and earlier
Timeline
- 2026-08-21: disclosed
- 2026-09-08: patched: Fixed in @xmldom/xmldom 0.8.15 and 0.9.12; xmldom 0.6.0 has no patch
- 2026-09-08: advisory