Threats tagged 'ghsa-mhmm-7px6-jx3j'

XML::Sig versions before 0.71 for Perl are vulnerable to XPath injection due to improper neutralization of data within XPath expressions. The vulnerability arises because the verify() and _get_signed_xml() functions build XPath queries by concatenating unescaped URI values from the document, allowing an attacker to inject arbitrary XPath operators. This can cause the digest verification process to select unintended XML nodes, potentially compromising the integrity verification of signed XML documents.