CVE-2026-9390: XML::Sig for Perl XXE Vulnerability

CVE-2026-9390 Overview

CVE-2026-9390 is an XPath injection vulnerability in the Perl module XML::Sig in versions before 0.71. The flaw resides in the verify() and _get_signed_xml() functions in lib/XML/Sig.pm, which build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. Because the value is neither escaped nor validated against the XML NCName grammar, a URI containing a single quote closes the string literal in the generated expression and appends attacker-controlled XPath operators. A crafted URI can force the lookup to match arbitrary elements, letting an attacker choose which node is passed to digest verification.

Critical Impact
An attacker can subvert XML signature verification by injecting XPath operators through the Reference/@URI attribute, breaking the integrity guarantees relied on by SAML and other signed-XML consumers built on XML::Sig.

Affected Products

XML::Sig for Perl versions prior to 0.71
Perl applications using XML::Sig for signed XML verification
SAML2 stacks such as perl-net-saml2 that depend on XML::Sig

Discovery Timeline

2026-08-03 - CVE-2026-9390 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-9390

Vulnerability Analysis

The vulnerability is classified as an XPath injection [CWE-643]. XML::Sig verifies digital signatures on XML documents by locating the referenced element through an XPath lookup keyed on the ID attribute. The routines verify() and _get_signed_xml() in lib/XML/Sig.pm read the URI attribute from the SignedInfo/Reference element and interpolate it directly into an XPath string literal. No escaping is applied and no grammar check is performed.

Because the parser trusts the untrusted URI value, an attacker who controls the XML document being verified can inject XPath syntax. The injected expression can select an element that differs from the one the signature legitimately covers, causing the digest to be computed over attacker-chosen content while the signature still validates.

Root Cause

The root cause is unsanitized concatenation of a document-supplied value into an XPath expression. XML specifies that an ID must conform to the NCName grammar, but XML::Sig did not enforce that constraint. Any character permitted in an XML attribute value, including the single quote used as an XPath string delimiter, was accepted and passed through to the query builder.

Attack Vector

An attacker crafts a signed XML document in which the Reference/@URI attribute contains XPath syntax such as a single quote followed by operators like or 1=1. When the victim application invokes verify(), the lookup no longer selects the intended element. The attacker chooses which node the signature is validated against, enabling signature-wrapping style abuse on SAML assertions, tokens, and other signed XML payloads processed over the network without authentication.

text

# Security patch in lib/XML/Sig.pm - Enforce the ID format as per the specification
 use constant TRANSFORM_EXC_C14N          => 'http://www.w3.org/2001/10/xml-exc-c14n#';
 use constant TRANSFORM_EXC_C14N_COMMENTS => 'http://www.w3.org/2001/10/xml-exc-c14n#WithComments';

+my $NCNameStartChar = qr{
+    [A-Z_a-z
+     \\xC0-\\xD6 \\xD8-\\xF6 \\xF8-\x{2FF}
+     \x{370}-\x{37D} \x{37F}-\x{1FFF}
+     \x{200C}-\x{200D}
+     \x{2070}-\x{218F}
+     \x{2C00}-\x{2FEF}
+     \x{3001}-\x{D7FF}
+     \x{F900}-\x{FDCF} \x{FDF0}-\x{FFFD}
+     \x{10000}-\x{EFFFF}]
+}x;
+
+my $NCNameChar = qr{
+    [A-Z_a-z
+     \\xC0-\\xD6 \\xD8-\\xF6 \\xF8-\x{2FF}
+     \x{370}-\x{37D} \x{37F}-\x{1FFF}
+     \x{200C}-\x{200D}
+     \x{2070}-\x{218F}
+     \x{2C00}-\x{2FEF}
+     \x{3001}-\x{D7FF}
+     \x{F900}-\x{FDCF} \x{FDF0}-\x{FFFD}
+     \x{10000}-\x{EFFFF}
+     \-.0-9\\xB7
+     \x{300}-\x{36F}
+     \x{203F}-\x{2040}]
+}x;

Source: GitHub Commit Patch 69ad2b4211. The patch introduces NCNameStartChar and NCNameChar regexes that constrain accepted ID values to the XML grammar, blocking the single-quote injection path.

Detection Methods for CVE-2026-9390

Indicators of Compromise

Signed XML documents where the Reference/@URI attribute contains characters outside the XML NCName set, such as ', ", spaces, parentheses, or operator keywords like or and and.
SAML assertions or responses whose signed element differs from the element referenced by ID, indicating signature wrapping.
Application logs from Perl services that show XML::Sig verifying documents with unusually long or non-alphanumeric URI fragments.

Detection Strategies

Inventory Perl workloads and identify any dependency on XML::Sig at versions below 0.71, including transitive use through Net::SAML2 and similar modules.
Add pre-verification input validation that rejects Reference/@URI values not matching the NCName grammar before passing documents to XML::Sig.
Instrument SAML service providers and identity brokers to log every URI reference processed by signature verification for offline analysis.

Monitoring Recommendations

Alert on authentication successes accompanied by malformed or previously unseen SAML ID values.
Monitor package registries and CI pipelines for pinned XML-Sig versions below 0.71.
Correlate signature-verification errors with subsequent privileged actions to identify wrapping attempts that bypassed integrity checks.

How to Mitigate CVE-2026-9390

Immediate Actions Required

Upgrade XML::Sig to version 0.71 or later on every host that verifies signed XML.
Rebuild and redeploy Perl applications and container images that bundle earlier XML::Sig releases.
Rotate any SAML signing keys or session tokens issued during the window when a vulnerable verifier was in use, if signature integrity cannot be confirmed.

Patch Information

The fix ships in XML-Sig-0.71 on CPAN. Two upstream commits implement and refine the remediation: GitHub Commit 69ad2b4211 introduces NCName enforcement, and GitHub Commit a85aad21aa tightens the regex. Release notes are available in the MetaCPAN Release Changes for XML-Sig.

Workarounds

Validate the Reference/@URI attribute against the XML NCName grammar in application code before invoking verify().
Reject documents containing single quotes, double quotes, or whitespace inside URI fragments at the ingress layer, such as a reverse proxy or WAF.
Restrict which signing certificates are trusted so that attacker-supplied documents cannot be validated even if XPath injection occurs.

bash

# Upgrade XML::Sig to the fixed release
cpanm XML::Sig@0.71

# Verify the installed version
perl -MXML::Sig -e 'print $XML::Sig::VERSION, "\n"'