xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

Description

Document.createProcessingInstruction() in @xmldom/xmldom performs no validation on the target parameter. The requireWellFormed: true serializer option validates only for : in the target and a case-insensitive xml prefix, but does not check for > characters. A > in the target breaks the processing instruction boundary (<?...?>), allowing injection of arbitrary content into the serialized XML output.

Recommendation

Update the @xmldom/xmldom package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 0.9.0, <= 0.9.11

  >= 0.7.0, <= 0.8.14**

• Patched version(s): **0.9.12

  0.8.15**

References

• GHSA-c7q8-3ch8-vqpv
• CVE-2026-83616
• CWE-91
• CAPEC-310