CVE-2026-41672

@@ -25,8 +25,11 @@ declare module "@xmldom/xmldom" {
   /** Options accepted by `XMLSerializer.prototype.serializeToString`. */
   interface XMLSerializerOptions {
       /**
-       * When `true`, the serializer throws a DOMException with code `INVALID_STATE_ERR` if the
-       * CDATASection data contains `"]]>"`.
+       * When `true`, the serializer throws a DOMException with code `INVALID_STATE_ERR` if:
+       * - A CDATASection node's data contains `"]]>"`.
+       * - A Comment node's data contains `"-->"` (the injection sequence that terminates a
+       *   comment). Comments whose data contains `"--"` but not `"-->"` are accepted on this
+       *   branch — the 0.8.x parser does not validate bare `"--"` in comment content.
        *
        * @default false
        */
@@ -50,7 +53,9 @@ declare module "@xmldom/xmldom" {
        *
        * @throws {DOMException}
        * With code `INVALID_STATE_ERR` when `requireWellFormed` is `true` and the CDATASection
-       * data contains `"]]>"`.
+       * data contains `"]]>"`, or a Comment node's data contains `"-->"`.
+       * (On this 0.8.x branch, bare `"--"` in comment data does not throw — see
+       * `XMLSerializerOptions.requireWellFormed` for details.)
        * @see https://html.spec.whatwg.org/#dom-xmlserializer-serializetostring
        * @see https://github.com/w3c/DOM-Parsing/issues/84
        */

@@ -1506,6 +1506,11 @@ function XMLSerializer(){}
  * @throws {DOMException}
  * With code `INVALID_STATE_ERR` when `requireWellFormed` is `true` and the CDATASection
  * data contains `"]]>"`.
+ * With code `INVALID_STATE_ERR` when `requireWellFormed` is `true` and a Comment node's
+ * data contains `"-->"` (the injection sequence that terminates a comment and allows
+ * arbitrary XML to follow). Comments whose data contains `"--"` but not `"-->"` are
+ * accepted — the 0.8.x parser does not validate bare `"--"` inside comment content,
+ * so throwing would break a previously-working round-trip.
  * @see https://html.spec.whatwg.org/#dom-xmlserializer-serializetostring
  * @see https://github.com/w3c/DOM-Parsing/issues/84
  */
@@ -1733,6 +1738,12 @@ function serializeToString(node,buf,isHTML,nodeFilter,visibleNamespaces,requireW
 		}
 		return buf.push('<![CDATA[', node.data.replace(/]]>/g, ']]]]><![CDATA[>'), ']]>');
 	case COMMENT_NODE:
+		if (requireWellFormed && node.data.indexOf('-->') !== -1) {
+			throw new DOMException(
+				INVALID_STATE_ERR,
+				'The comment node data contains "-->"'
+			);
+		}
 		return buf.push( "<!--",node.data,"-->");
 	case DOCUMENT_TYPE_NODE:
 		var pubid = node.publicId;

@@ -387,4 +387,44 @@ describe('XMLSerializer serializeToString requireWellFormed option', () => {
 			doc.toString(false, null, { requireWellFormed: true })
 		).toThrow(DOMException)
 	})
+
+	describe('Comment', () => {
+		it('default: comment with "-->" in data emits verbatim — no throw', () => {
+			const comment = doc.createComment('safe-->evil')
+			doc.documentElement.appendChild(comment)
+			expect(new XMLSerializer().serializeToString(doc.documentElement)).toBe(
+				'<root><!--safe-->evil--></root>'
+			)
+		})
+
+		it('requireWellFormed: true on comment with "-->" throws InvalidStateError', () => {
+			const comment = doc.createComment('safe-->evil')
+			doc.documentElement.appendChild(comment)
+			expect(() =>
+				new XMLSerializer().serializeToString(doc, false, null, {
+					requireWellFormed: true,
+				})
+			).toThrow(DOMException)
+		})
+
+		it('requireWellFormed: true on comment with "--" (no "-->") does not throw — intentional on 0.8.x', () => {
+			const comment = doc.createComment('hello--world')
+			doc.documentElement.appendChild(comment)
+			expect(
+				new XMLSerializer().serializeToString(doc, false, null, {
+					requireWellFormed: true,
+				})
+			).toBe('<root><!--hello--world--></root>')
+		})
+
+		it('requireWellFormed: true on comment with clean data serializes correctly', () => {
+			const comment = doc.createComment('safe comment')
+			doc.documentElement.appendChild(comment)
+			expect(
+				new XMLSerializer().serializeToString(doc, false, null, {
+					requireWellFormed: true,
+				})
+			).toBe('<root><!--safe comment--></root>')
+		})
+	})
 })

@@ -1209,6 +1209,11 @@ declare module '@xmldom/xmldom' {
 		/**
 		 * Creates a comment object with the specified data.
 		 *
+		 * No validation is performed at creation time. When the resulting document is serialized
+		 * with `requireWellFormed: true`, the serializer throws `InvalidStateError` if the comment
+		 * data contains `--` anywhere, ends with `-`, or contains characters outside the XML Char
+		 * production (W3C DOM Parsing §3.2.1.3). Without that option the data is emitted verbatim.
+		 *
 		 * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Document/createComment)
 		 */
 		createComment(data: string): Comment;
@@ -1470,8 +1475,9 @@ declare module '@xmldom/xmldom' {
 	interface XMLSerializerOptions {
 		/**
 		 * When `true`, the serializer throws `InvalidStateError` for content that would produce
-		 * ill-formed XML (CDATASection data containing `"]]>"`, Text data with characters outside
-		 * the XML Char production, or a Document with no `documentElement`).
+		 * ill-formed XML: CDATASection data containing `"]]>"`; Text data with characters outside
+		 * the XML Char production; a Comment node whose data contains `--` anywhere or ends with
+		 * `-`; or a Document with no `documentElement`.
 		 *
 		 * @default false
 		 */

@@ -2218,6 +2218,15 @@ Document.prototype = {
 	/**
 	 * @param {string} data
 	 * @returns {Comment}
+	 * @see https://dom.spec.whatwg.org/#dom-document-createcomment
+	 * @see https://www.w3.org/TR/xml/#NT-Comment XML 1.0 production [15]
+	 * @see https://www.w3.org/TR/DOM-Parsing/#dfn-concept-serialize-xml §3.2.1.3
+	 *
+	 *      Note: no validation is performed at creation time. When the resulting document is
+	 *      serialized with `requireWellFormed: true`, the serializer throws `InvalidStateError`
+	 *      if the comment data contains `--` anywhere, ends with `-`, or contains characters
+	 *      outside the XML Char production (W3C DOM Parsing §3.2.1.3). Without that option the
+	 *      data is emitted verbatim.
 	 */
 	createComment: function (data) {
 		var node = new Comment(PDC);
@@ -2761,9 +2770,10 @@ function XMLSerializer() {}
  * A filter function applied to each node before serialization.
  * @returns {string}
  * @throws {DOMException}
- * With name `InvalidStateError` when `requireWellFormed` is `true` and the CDATASection data
- * contains `"]]>"`, Text data contains characters outside the XML Char production, or the
- * Document has no `documentElement`.
+ * With name `InvalidStateError` when `requireWellFormed` is `true` and any of the following
+ * conditions hold: CDATASection data contains `"]]>"`; Text data contains characters outside
+ * the XML Char production; a Comment node's data contains `--` anywhere or ends with `-`;
+ * the Document has no `documentElement`.
  * @see https://html.spec.whatwg.org/#dom-xmlserializer-serializetostring
  * @see https://github.com/w3c/DOM-Parsing/issues/84
  */
@@ -3022,6 +3032,17 @@ function serializeToString(node, buf, visibleNamespaces, opts) {
 			}
 			return buf.push(g.CDATA_START, node.data, g.CDATA_END);
 		case COMMENT_NODE:
+			if (requireWellFormed) {
+				if (g.InvalidChar.test(node.data)) {
+					throw new DOMException(
+						'The comment node data contains characters outside the XML Char production',
+						'InvalidStateError'
+					);
+				}
+				if (node.data.indexOf('--') !== -1 || node.data[node.data.length - 1] === '-') {
+					throw new DOMException('The comment node data contains "--" or ends with "-"', 'InvalidStateError');
+				}
+			}
 			return buf.push(g.COMMENT_START, node.data, g.COMMENT_END);
 		case DOCUMENT_TYPE_NODE:
 			var pubid = node.publicId;

@@ -309,6 +309,50 @@ describe('XMLSerializer.serializeToString', () => {
 				expect(() => new XMLSerializer().serializeToString(doc, { requireWellFormed: true })).not.toThrow();
 			});
 		});
+
+		describe('Comment', () => {
+			test('default: comment with "-->" in data emits verbatim — no throw', () => {
+				doc.documentElement.appendChild(doc.createComment('hello-->world'));
+				expect(new XMLSerializer().serializeToString(doc)).toBe('<root><!--hello-->world--></root>');
+			});
+
+			test('default: comment with "--" in data emits verbatim — no throw', () => {
+				doc.documentElement.appendChild(doc.createComment('hello--world'));
+				expect(new XMLSerializer().serializeToString(doc)).toBe('<root><!--hello--world--></root>');
+			});
+
+			test('requireWellFormed: true on comment with invalid XML Char (\\x00) throws InvalidStateError', () => {
+				doc.documentElement.appendChild(doc.createComment('hello\x00world'));
+				expectDOMException(() => new XMLSerializer().serializeToString(doc, { requireWellFormed: true }), 'InvalidStateError');
+			});
+
+			test('requireWellFormed: true on comment with "-->" throws InvalidStateError', () => {
+				doc.documentElement.appendChild(doc.createComment('hello-->world'));
+				expectDOMException(() => new XMLSerializer().serializeToString(doc, { requireWellFormed: true }), 'InvalidStateError');
+			});
+
+			test('requireWellFormed: true on comment with "--" (no "-->") throws InvalidStateError', () => {
+				doc.documentElement.appendChild(doc.createComment('hello--world'));
+				expectDOMException(() => new XMLSerializer().serializeToString(doc, { requireWellFormed: true }), 'InvalidStateError');
+			});
+
+			test('requireWellFormed: true on comment whose data ends with "-" throws InvalidStateError', () => {
+				doc.documentElement.appendChild(doc.createComment('hello-'));
+				expectDOMException(() => new XMLSerializer().serializeToString(doc, { requireWellFormed: true }), 'InvalidStateError');
+			});
+
+			test('requireWellFormed: true on comment with clean data does not throw', () => {
+				doc.documentElement.appendChild(doc.createComment('clean comment'));
+				expect(() => new XMLSerializer().serializeToString(doc, { requireWellFormed: true })).not.toThrow();
+			});
+
+			test('mutation vector: appendData("-->") then requireWellFormed: true throws InvalidStateError', () => {
+				const comment = doc.createComment('clean');
+				doc.documentElement.appendChild(comment);
+				comment.appendData('-->');
+				expectDOMException(() => new XMLSerializer().serializeToString(doc, { requireWellFormed: true }), 'InvalidStateError');
+			});
+		});
 	});
 });