CVE-2026-9390 in XML::Sig
Summary
by MITRE • 08/03/2026
XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup.
verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName grammar that XML requires of an ID, so a URI containing a single quote closes the string literal in the generated expression and appends arbitrary XPath operators.
A crafted URI can make the lookup match elements the reference does not name, or every element in the document, so which node is selected for digest verification is decided by the injected expression rather than by the reference.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability in XML::Sig versions prior to 071 represents a critical XPath injection flaw that fundamentally compromises the security of XML signature verification processes. This issue resides in the core verification logic implemented in lib/XML/Sig.pm where the verify() and _get_signed_xml() functions construct XPath expressions through direct string concatenation of the URI value from SignedInfo/Reference/@URI elements. The absence of proper input sanitization or validation creates an environment where maliciously crafted URIs can manipulate the XPath evaluation process, potentially allowing attackers to bypass signature verification entirely.
The technical implementation flaw stems from the lack of proper escaping mechanisms and grammar validation for ID values within XML documents. According to CWE-643, this represents a well-documented vulnerability pattern involving insufficient input validation in XPath expressions. The NCName grammar requirements of XML specification mandate that IDs must conform to specific naming rules, yet the vulnerable code fails to enforce these constraints. When a URI containing single quotes is processed, it terminates the string literal within the generated XPath expression, enabling attackers to inject arbitrary XPath operators and modify the intended selection criteria.
The operational impact of this vulnerability extends beyond simple bypass scenarios to potentially enable complete compromise of XML signature integrity. An attacker can craft a malicious URI that causes the XPath expression to select unintended nodes for digest verification, meaning that the cryptographic hash computed over the wrong data can pass validation. This creates a scenario where forged signatures might be accepted, undermining the fundamental security guarantees that XML signatures are designed to provide. The vulnerability affects any system relying on XML::Sig for signature verification, particularly those processing untrusted XML documents from external sources.
This vulnerability aligns with ATT&CK technique T1571 by enabling manipulation of XML processing logic and can facilitate broader attacks through XML-based exploitation vectors. Organizations implementing XML signature validation using affected versions face significant risk as attackers could potentially modify document content while maintaining valid signatures, leading to data integrity compromises. The attack surface is particularly broad since many web applications and security protocols rely on XML signatures for authentication and data integrity verification.
Mitigation strategies should prioritize immediate upgrade to XML::Sig version 0.71 or later where proper input validation has been implemented. Additionally, administrators should consider implementing input validation at the application level to sanitize URI values before processing, though this represents a temporary workaround rather than a permanent solution. The fix typically involves implementing proper escaping of special XPath characters and enforcing NCName grammar compliance for ID values, aligning with security best practices outlined in OWASP Top Ten and NIST guidelines for XML security implementation.