XML::Sig EUVD-2026-52269

Exploitation requires that the target application call XML::Sig verify()/_get_signed_xml() on an XML document whose SignedInfo/Reference/@URI value is attacker-influenced - i.e. any flow that verifies externally supplied signed XML (the canonical case being SAML message/assertion verification via perl-net-saml2). The concrete trigger is a Reference @URI that violates the XML NCName grammar by embedding a single quote plus XPath operators, which pre-0.71 code passes unescaped into the ID-lookup XPath. Per CVSS AV:N/AC:L/PR:N/UI:N there is no authentication or user interaction required beyond the ability to deliver the crafted document to the verifier. Limiting factors: the affected code path must actually be reached (the application must perform verification, not merely signing), the deployed XML::Sig must be older than 0.71, and the attacker must be able to submit XML to that verification endpoint - deployments that only sign, or that already validate URIs upstream, are not exposed.

The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H, 9.1 Critical) reflects a network-reachable, unauthenticated, low-complexity flaw with high integrity impact - appropriate for a library that adjudicates signature trust, since an attacker who can bypass signature checks can forge authenticated SAML assertions or signed messages. That said, the stated C:H is generous: the described impact is fundamentally an integrity/authentication bypass (which node is trusted), not a confidentiality leak, so the practical damage is authentication bypass rather than data disclosure. Signals are otherwise limited: there is no EPSS score, KEV entry, or SSVC record in the provided data, and no POC is referenced - so this is a high-severity-by-design issue whose real-world exploitation is currently unproven. Priority should still be high for anyone running perl-net-saml2 or otherwise verifying externally supplied XML with XML::Sig, because exploitation requires only crafting a malicious signed document, which is squarely within an attacker's control. Absence of EPSS/KEV data should be read as 'not yet observed / not measured,' not as low risk.

An attacker who can present a signed XML document to a service using XML::Sig - for example a forged SAML response sent to a Perl service provider - crafts a SignedInfo/Reference/@URI containing a single quote and injected XPath (such as a predicate that matches every element or an unrelated node). When verify() resolves the reference, the injected expression, not the reference, selects which node is digested, so the digest check passes against a node the attacker controls while the actual assertion body is unsigned or substituted, yielding signature/authentication bypass. No POC is publicly referenced, but the network vector and low complexity make a hand-crafted document sufficient.