EUVD-2026-52269
GHSA-mhmm-7px6-jx3j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Remote, unauthenticated, low-complexity crafting of a signed document (AV:N/AC:L/PR:N/UI:N); impact is signature/authentication bypass so I:H, with no genuine confidentiality or availability loss (C:N/A:N).
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
5DescriptionCVE.org
XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup.
verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName grammar that XML requires of an ID, so a URI containing a single quote closes the string literal in the generated expression and appends arbitrary XPath operators.
A crafted URI can make the lookup match elements the reference does not name, or every element in the document, so which node is selected for digest verification is decided by the injected expression rather than by the reference.
AnalysisAI
Signature-verification bypass in the Perl XML::Sig module before 0.71 allows remote attackers to forge which document node is validated by injecting XPath operators through the SignedInfo/Reference/@URI attribute. Because verify() and _get_signed_xml() concatenate the attacker-controlled URI into an XPath expression without escaping or NCName validation, a single quote breaks out of the string literal and lets the injected expression decide which element is digest-checked - undermining the integrity guarantee of any XML Signature the library verifies. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application call XML::Sig verify()/_get_signed_xml() on an XML document whose SignedInfo/Reference/@URI value is attacker-influenced - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H, 9.1 Critical) reflects a network-reachable, unauthenticated, low-complexity flaw with high integrity impact - appropriate for a library that adjudicates signature trust, since an attacker who can bypass signature checks can forge authenticated SAML assertions or signed messages. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can present a signed XML document to a service using XML::Sig - for example a forged SAML response sent to a Perl service provider - crafts a SignedInfo/Reference/@URI containing a single quote and injected XPath (such as a predicate that matches every element or an unrelated node). When verify() resolves the reference, the injected expression, not the reference, selects which node is digested, so the digest check passes against a node the attacker controls while the actual assertion body is unsigned or substituted, yielding signature/authentication bypass. … |
| Remediation | Vendor-released patch: upgrade XML::Sig to version 0.71 or later from CPAN (metacpan.org/release/TIMLEGGE/XML-Sig-0.71), which enforces the NCName grammar on Reference URIs and XML IDs and rejects malformed values with a croak. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all applications and systems using Perl XML::Sig library, prioritizing those involved in authentication, document verification, or secure transactions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Out-of-bounds read in the XML::Bare Perl XML parser (all releases through 0.53) lets a remote attacker crash the parsing
Signature verification bypass in the Perl XML::Sig module before 0.71 allows XML Signature Wrapping (XSW) via duplicate
Signature verification bypass in XML::Sig (Perl) versions 0.29 through 0.71 allows remote unauthenticated attackers to s
Out-of-bounds heap read in XML::LibXML for Perl (all versions through 2.0210) allows remote attackers to trigger denial-
Denial of service in the Perl XML::Bare module (versions through 0.53) allows remote attackers to force an infinite loop
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today