xmldom: XML node injection through unvalidated comment serialization

The xmldom library fails to properly escape special characters in XML comments, allowing attackers to break out of comments and inject malicious XML code into the output. This can lead to data corruption or security vulnerabilities in applications that process untrusted XML data.

XML comment serialization in xmldom prior to versions 0.9.10 and 0.8.13 does not validate or neutralize comment-terminating sequences (CWE-91: XML injection), allowing an attacker who controls comment content to prematurely close the comment and inject arbitrary XML nodes into the serialized output. The vulnerability requires attacker input to be included in XML comments processed by the library's XMLSerializer.