xmldom has XML node injection through unvalidated processing instruction serialization

Description

The package allows attacker-controlled processing instruction data to be serialized into XML without validating or neutralizing the PI-closing sequence ?>. As a result, an attacker can terminate the processing instruction early and inject arbitrary XML nodes into the serialized output.

Recommendation

Update the @xmldom/xmldom package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 0.9.0, < 0.9.10

  < 0.8.13**

• Patched version(s): **0.9.10

  0.8.13**

References

• GHSA-x6wf-f3px-wcqx
• CVE-2026-41675
• CWE-91
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6