XPath Injection Vulnerability in XML::Sig for Perl
CVE-2026-9390
Currently unrated
What is CVE-2026-9390?
The XML::Sig library for Perl prior to version 0.71 is susceptible to XPath injection due to insufficient validation of URI inputs. The vulnerable functions, verify() and _get_signed_xml(), construct XPath queries using SignedInfo/Reference/@URI values without proper escaping or compliance checks against XML's NCName grammar. An attacker could exploit this vulnerability by crafting a malicious URI, allowing arbitrary XPath expressions to be executed. This may lead to unauthorized access to XML elements, undermining the integrity of the XML signature verification process.
Affected Version(s)
XML::Sig 0 < 0.71