CVE-2026-9390 Details
Description
XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName grammar that XML requires of an ID, so a URI containing a single quote closes the string literal in the generated expression and appends arbitrary XPath operators. A crafted URI can make the lookup match elements the reference does not name, or every element in the document, so which node is selected for digest verification is decided by the injected expression rather than by the reference.
A vulnerability allowing XPath injection has been identified in XML::Sig versions prior to 0.71 for Perl. The issue arises in the ID lookup and verification of signed XML, where the library concatenates the URI values from the XML document without proper escaping or validation. This flaw allows attackers to inject arbitrary XPath expressions, potentially manipulating which nodes are selected for digest verification, and could lead to bypassing signature validation.
Users can upgrade to XML::Sig version 0.71 or later, where this vulnerability has been addressed. Instructions for updating can be found on the MetaCPAN XML::Sig release page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/perl-net-saml2/perl-XML-Sig/commit/69ad2b421118fadd33d57f50b110b8d161e8fef5.patch | CPANSec | Patch |
| https://github.com/perl-net-saml2/perl-XML-Sig/commit/a85aad21aa767ac1c158bbfc19447683941ab376.patch | CPANSec | Patch |
| https://metacpan.org/release/TIMLEGGE/XML-Sig-0.71/changes | CPANSec | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1287 | Improper Validation of Specified Type of Input | CPANSec |
| CWE-643 | Improper Neutralization of Data within XPath Expressions ('XPath Injection') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| xml::sig project xml::sig | < 0.71 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | Initial Analysis | [email protected] |
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | CPANSec |