CVE-2026-9390 describes an XPath injection vulnerability in XML::Sig for Perl versions prior to 0.71. The functions verify() and _get_signed_xml() construct XPath expressions by directly concatenating the SignedInfo/Reference/@URI value from the XML document without escaping or validating it against the NCName grammar. An attacker can craft a URI containing a single quote to break out of the string literal in the XPath expression and append arbitrary XPath operators. This manipulation can cause the XPath query to match XML elements not intended by the reference, potentially allowing an attacker to influence which node is selected for digest verification and thus undermine the signature validation process.

Successful exploitation allows an attacker to manipulate the XPath query used during XML signature verification, causing the verification process to validate unintended XML nodes. This can lead to bypassing signature integrity checks, potentially allowing tampering with signed XML data without detection. The CVSS score of 9.1 indicates a critical severity with high confidentiality and integrity impact, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid processing untrusted XML documents with vulnerable versions of XML::Sig. Consider applying input validation or escaping on the SignedInfo/Reference/@URI values before they are used in XPath expressions to mitigate injection risks.