# xmldom 0.9.9

- Product: xmldom (https://whatsnew.fyi/product/xmldom)
- Vendor: xmldom
- Date: 2026-03-29
- Version: 0.9.9
- Original notes: https://github.com/xmldom/xmldom/releases/tag/0.9.9
- Permalink: https://whatsnew.fyi/product/xmldom/releases/0.9.9

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Implement ParentNode.children getter
- **security** — createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec
- **security** — XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods
- **fixed** — Correctly traverse ancestor chain in Node.contains

[Commits](https://github.com/xmldom/xmldom/compare/0.9.8...0.9.9)

###### Added

- implement `ParentNode.children` getter [`#960`](https://github.com/xmldom/xmldom/pull/960) / [`#410`](https://github.com/xmldom/xmldom/issues/410)

###### Fixed

- Security: `createCDATASection` now throws `InvalidCharacterError` when `data` contains `"]]>"`, as required by the [WHATWG DOM spec](https://dom.spec.whatwg.org/#dom-document-createcdatasection). [`GHSA-wh4c-j3r5-mjhp`](https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp)
- Security: `XMLSerializer` now splits CDATASection nodes whose data contains `"]]>"` into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (`appendData`, `replaceData`, `.data =`, `.textContent =`). [`GHSA-wh4c-j3r5-mjhp`](https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp)
- correctly traverse ancestor chain in `Node.contains` [`#931`](https://github.com/xmldom/xmldom/pull/931)

Code that passes a string containing `"]]>"` to `createCDATASection` and relied on the previously unsafe behavior will now receive `InvalidCharacterError`. Use a mutation method such as `appendData` if you intentionally need `"]]>"` in a CDATASection node's data.

###### Chore

- updated dependencies

Thank you,
[@stevenobiajulu](https://github.com/stevenobiajulu),
[@yoshi389111](https://github.com/yoshi389111),
[@thesmartshadow](https://github.com/thesmartshadow),
for your contributions

https://github.com/xmldom/xmldom/discussions/435