Skip to content
OpenAdvisories

Product · TIMLEGGE

XML::Sig

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-9487

    XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID

    XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression "//*[@ID='$id']" and returns the first node…

    TIMLEGGE XML::Sig
  • Critical 9.1
    CVE-2026-9390

    XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup

    XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neithe…

    TIMLEGGE XML::Sig
  • Critical 9.3
    CVE-2025-40934

    XML-Sig prior to 0.68 for Perl improperly validates XML without signatures

    XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from the XML document to make it pass the verification check. XML-Sig is a Perl module to validate signatures on XML fi…

    TIMLEGGE XML::Sig perl-xml-sig Alpine