Misinterpretation of malicious XML input

The xmldom library doesn't properly handle specially crafted XML documents when parsing and converting them back to text, which can cause unexpected changes in the document structure. This could allow an attacker to alter XML content in ways that bypass security checks in applications using this library.

xmldom ≤0.4.0 fails to correctly preserve system identifiers, FPIs, and namespaces during repeated parse-serialize cycles on maliciously crafted XML. An unauthenticated attacker can supply malicious XML input that, when processed by vulnerable downstream applications, undergoes syntactic transformation that may circumvent validation logic or security policies (CWE-115: Misinterpreted Input, CWE-436: Interpretation Conflict).