Product
The @xmldom/xmldom library fails to validate attribute names during the use of Element.setAttribute, allowing attackers to inject malicious attributes into serialized XML output leading to potential XSS.