CVE-2026-9390
Received Received - Intake

XPath Injection in XML::Sig Perl Module

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: CPANSec

Description
XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName grammar that XML requires of an ID, so a URI containing a single quote closes the string literal in the generated expression and appends arbitrary XPath operators. A crafted URI can make the lookup match elements the reference does not name, or every element in the document, so which node is selected for digest verification is decided by the injected expression rather than by the reference.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-9390
EUVD
EUVD-2026-52269

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
xml xml_sig to 0.71 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1287 The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
CWE-643 The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

XML::Sig versions before 0.71 for Perl have an XPath injection vulnerability in ID lookup. The verify() and _get_signed_xml() functions build XPath expressions by concatenating the SignedInfo/Reference/@URI value from the document without proper escaping or validation. This allows a crafted URI to inject XPath operators, altering the node selection for digest verification.

Detection Guidance

This vulnerability is specific to Perl's XML::Sig library versions before 0.71 and involves XPath injection in ID lookup. Detection requires checking installed Perl modules and reviewing XML signature verification code for unsafe XPath construction. No direct network or system commands are provided in the context to detect this issue.

Impact Analysis

An attacker could exploit this to manipulate which parts of an XML document are verified, potentially bypassing signature checks. This could allow unauthorized modifications to signed data without detection, leading to data tampering or spoofing attacks.

Compliance Impact

This vulnerability could undermine integrity checks required by GDPR and HIPAA for data protection. If signatures are bypassed, it may lead to unauthorized data access or tampering, violating compliance requirements for data integrity and security.

Mitigation Strategies

Update XML::Sig to version 0.71 or later to address the XPath injection flaw in ID lookup mechanisms.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9390. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart