CVE-2026-9390

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9390", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-05-23T20:04:32.906Z", "datePublished": "2026-08-03T13:09:40.158Z", "dateUpdated": "2026-08-03T19:58:50.173Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "XML-Sig", "product": "XML::Sig", "programFiles": ["lib/XML/Sig.pm"], "programRoutines": [{"name": "XML::Sig::verify"}, {"name": "XML::Sig::_get_signed_xml"}], "repo": "https://github.com/perl-net-saml2/perl-XML-Sig", "vendor": "TIMLEGGE", "versions": [{"lessThan": "0.71", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup.\n\nverify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName grammar that XML requires of an ID, so a URI containing a single quote closes the string literal in the generated expression and appends arbitrary XPath operators.\n\nA crafted URI can make the lookup match elements the reference does not name, or every element in the document, so which node is selected for digest verification is decided by the injected expression rather than by the reference."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-643", "description": "CWE-643 Improper Neutralization of Data within XPath Expressions ('XPath Injection')", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1287", "description": "CWE-1287 Improper Validation of Specified Type of Input", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-08-03T13:09:40.158Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/perl-net-saml2/perl-XML-Sig/commit/69ad2b421118fadd33d57f50b110b8d161e8fef5.patch"}, {"tags": ["patch"], "url": "https://github.com/perl-net-saml2/perl-XML-Sig/commit/a85aad21aa767ac1c158bbfc19447683941ab376.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/TIMLEGGE/XML-Sig-0.71/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to version 0.71"}], "source": {"discovery": "UNKNOWN"}, "title": "XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-03T19:58:29.107052Z", "id": "CVE-2026-9390", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T19:58:50.173Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-9390", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-03T19:58:29.107052Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T19:58:45.817Z"}}], "cna": {"title": "XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/perl-net-saml2/perl-XML-Sig", "vendor": "TIMLEGGE", "product": "XML::Sig", "versions": [{"status": "affected", "version": "0", "lessThan": "0.71", "versionType": "custom"}], "packageName": "XML-Sig", "programFiles": ["lib/XML/Sig.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "XML::Sig::verify"}, {"name": "XML::Sig::_get_signed_xml"}]}], "solutions": [{"lang": "en", "value": "Upgrade to version 0.71"}], "references": [{"url": "https://github.com/perl-net-saml2/perl-XML-Sig/commit/69ad2b421118fadd33d57f50b110b8d161e8fef5.patch", "tags": ["patch"]}, {"url": "https://github.com/perl-net-saml2/perl-XML-Sig/commit/a85aad21aa767ac1c158bbfc19447683941ab376.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/TIMLEGGE/XML-Sig-0.71/changes", "tags": ["release-notes"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup.\n\nverify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName grammar that XML requires of an ID, so a URI containing a single quote closes the string literal in the generated expression and appends arbitrary XPath operators.\n\nA crafted URI can make the lookup match elements the reference does not name, or every element in the document, so which node is selected for digest verification is decided by the injected expression rather than by the reference."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-643", "description": "CWE-643 Improper Neutralization of Data within XPath Expressions ('XPath Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1287", "description": "CWE-1287 Improper Validation of Specified Type of Input"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-08-03T13:09:40.158Z"}}}, "cveMetadata": {"cveId": "CVE-2026-9390", "state": "PUBLISHED", "dateUpdated": "2026-08-03T19:58:50.173Z", "dateReserved": "2026-05-23T20:04:32.906Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-08-03T13:09:40.158Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "XML-Sig", "product": "XML::Sig", "programFiles": ["lib/XML/Sig.pm"], "programRoutines": [{"name": "XML::Sig::verify"}, {"name": "XML::Sig::_get_signed_xml"}], "repo": "https://github.com/perl-net-saml2/perl-XML-Sig", "vendor": "TIMLEGGE", "versions": [{"lessThan": "0.71", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:xml\\:\\:sig_project:xml\\:\\:sig:*:*:*:*:*:perl:*:*", "matchCriteriaId": "FC1BDEFE-0662-4F7C-9641-A32B9CF06366", "versionEndExcluding": "0.71", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup.\n\nverify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName grammar that XML requires of an ID, so a URI containing a single quote closes the string literal in the generated expression and appends arbitrary XPath operators.\n\nA crafted URI can make the lookup match elements the reference does not name, or every element in the document, so which node is selected for digest verification is decided by the injected expression rather than by the reference."}, {"lang": "es", "value": "Las versiones de XML::Sig anteriores a la 0.71 para Perl permiten la inyecci\u00f3n de XPath en la b\u00fasqueda de ID.\n\nverify() y _get_signed_xml() en lib/XML/Sig.pm construyen expresiones XPath concatenando el valor SignedInfo/Reference/@URI le\u00eddo del documento que se est\u00e1 verificando. El valor no se escapa ni se verifica contra la gram\u00e1tica NCName que XML requiere para un ID, por lo que un URI que contiene una comilla simple cierra el literal de cadena en la expresi\u00f3n generada y a\u00f1ade operadores XPath arbitrarios.\n\nUn URI manipulado puede hacer que la b\u00fasqueda coincida con elementos que la referencia no nombra, o con cada elemento del documento, por lo que qu\u00e9 nodo se selecciona para la verificaci\u00f3n del resumen es decidido por la expresi\u00f3n inyectada en lugar de por la referencia."}], "id": "CVE-2026-9390", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9390", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-03T19:58:29.107052Z", "version": "2.0.3"}}]}, "published": "2026-08-03T14:16:30.983", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Patch"], "url": "https://github.com/perl-net-saml2/perl-XML-Sig/commit/69ad2b421118fadd33d57f50b110b8d161e8fef5.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Patch"], "url": "https://github.com/perl-net-saml2/perl-XML-Sig/commit/a85aad21aa767ac1c158bbfc19447683941ab376.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Release Notes"], "url": "https://metacpan.org/release/TIMLEGGE/XML-Sig-0.71/changes"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-643"}, {"lang": "en", "value": "CWE-1287"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.71)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "XML::Sig", "source": "cna", "vendor": "TIMLEGGE"}, "product": "xml::sig", "vendor": "timlegge"}], "created": "2026-08-03T15:51:32.333465+00:00", "updated": "2026-08-04T10:30:07.269653+00:00", "vendors": ["timlegge", "timlegge$PRODUCT$xml::sig"]}