Critical 9.1Published Aug 3, 2026

CVE-2026-9390XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup

Updated under an hour ago (2026-10-19 09:10 UTC)

Does this affect you?

It affects TIMLEGGE XML::Sig and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for TIMLEGGE XML::Sig

Exploited in the last 30 days

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName grammar that XML requires of an ID, so a URI containing a single quote closes the string literal in the generated expression and appends arbitrary XPath operators. A crafted URI can make the lookup match elements the reference does not name, or every element in the document, so which node is selected for digest verification is decided by the injected expression rather than by the reference.

CVSS: 9.1 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-643, CWE-1287
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: CPANSec
NVD analysis: Analyzed
Record last updated: Aug 3, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

TIMLEGGE XML::Sig timlegge:xml_sig (from the name)	before 0.71	CNA record
xml::sig_project xml::sig xml::sig_project:xml::sig	before 0.71	NVD

References

https://github.com/perl-net-saml2/perl-XML-Sig/commit/69ad2b421118fadd33d57f50b110b8d161e8fef5.patchpatch
https://github.com/perl-net-saml2/perl-XML-Sig/commit/a85aad21aa767ac1c158bbfc19447683941ab376.patchpatch
https://metacpan.org/release/TIMLEGGE/XML-Sig-0.71/changesrelease-notes

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.