CVE-2026-9390

Name of the Vulnerable Software and Affected Versions XML::Sig versions prior to 0.71

Description XPath injection is possible during ID lookup. The functions verify() and get signed xml() in lib/XML/Sig.pm construct XPath expressions by concatenating the SignedInfo/Reference/@URI value from the document being verified. Because this value is not escaped or validated against the NCName grammar required for XML IDs, a URI containing a single quote can terminate the string literal and allow the addition of arbitrary XPath operators. This allows a crafted URI to manipulate the lookup process to match unintended elements or all elements in the document, letting the injected expression determine which node is selected for digest verification instead of the reference.

Recommendations Update XML::Sig to version 0.71 or later.