xmldom: Element name injection via createElement() bypasses requireWellFormed

Description

Document.createElement() in @xmldom/xmldom accepts arbitrary strings as the tagName parameter with zero validation. The serializer emits the tag name verbatim into XML/HTML output.

Recommendation

Update the @xmldom/xmldom package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 0.7.0, <= 0.8.13

  >= 0.9.0, <= 0.9.10**

• Patched version(s): **0.8.14

  0.9.11**

References

• GHSA-w2rr-34g9-rvrj
• CVE-2026-83607
• CWE-91
• CAPEC-310