Executive brief
The @xmldom/xmldom library contains a flaw in its XML serialization validation that allows attackers to bypass security checks intended to prevent malicious DOCTYPE declarations. When serializing DOM documents with the requireWellFormed option enabled, an attacker can embed line breaks in publicId or systemId attributes to inject arbitrary XML markup (such as entity declarations) that breaks out of the DOCTYPE definition. This affects applications that rely on this validation to safely process untrusted XML documents.
Technical details
The vulnerability is a regex validation bypass in the XMLSerializer's requireWellFormed check for DocumentType publicId and systemId fields. The root cause stems from a shared regexp builder (in lib/grammar.js) that compiles validators with the multiline flag (m), causing anchors (^$) to match at line boundaries rather than string boundaries. An attacker can craft a publicId or systemId containing a valid XML literal on the first line followed by a line terminator (U+000A, U+000D, U+2028, U+2029) and malicious markup thereafter. The regex .test() method accepts this because the first line passes validation, but the entire value—including injected markup—is emitted verbatim into the DOCTYPE declaration. Attack requires control over DocumentType creation (via createDocumentType) and serialization with requireWellFormed: true option. The fix in version 0.9.12 rejects any publicId or systemId containing ECMAScript line terminators when requireWellFormed is enabled. Versions 0.8.x are unaffected due to use of non-multiline regex patterns; the unscoped xmldom package has no requireWellFormed feature. The default serialization path (without requireWellFormed) remains unchanged and continues to emit verbatim output.
Affected products
- xmldom @xmldom/xmldom 0.9.10, 0.9.11
Timeline
- 2026-08-21: disclosed
- 2026-09-08: advisory
- 2026-09-08: patched: Version 0.9.12 released with fix