xmldom: XML injection through unvalidated DocumentType serialization
No sign of exploitation. No public exploitation artifact known so far.
The xmldom library doesn't properly escape special characters when converting XML documents to strings, allowing attackers to inject malicious XML code through the DOCTYPE declaration. This can lead to security bypasses or injection attacks in applications that process untrusted XML data.
The vulnerability exists in XMLSerializer.serializeToString when serializing DocumentType nodes; attacker-controlled publicId, systemId, and internalSubset fields are written without escaping, enabling DOCTYPE injection that terminates the declaration early and inserts arbitrary markup. Exploitation requires an attacker to control DocumentType fields in XML processing workflows, potentially leading to XXE or XML injection attacks.