CVE-2025-29775 xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

🗓️ 14 Mar 2025 17:11:05Reported by GitHub_MType

CVE-2025-29775 allows XML Signature Verification Bypass in xml-crypto prior to certain versions.

Reporter	Title	Published	Views	Family All 27
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js modules axios and xml-crypto (CVE-2025-27152, CVE-2025-29774, CVE-2025-29775 and CVE-2024-57965)	16 Apr 202515:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to Improper Verification of Cryptographic Signature due to xml-crypto ( CVE-2025-29774, CVE-2025-29775 )	20 Jun 202506:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to bypass signature validation in XML data [CVE-2025-29774] [CVE-2025-29775]	8 May 202517:57	–	ibm
BDU FSTEC	The vulnerability of the encryption and digital signature verification library in the Node.js software platform xml-crypto is related to deficiencies in the mechanism for verifying cryptographic signatures. This vulnerability allows attackers to enhance their privileges.	17 Mar 202500:00	–	bdu_fstec
Chainguard	CVE-2025-29775 vulnerabilities	17 Mar 202522:12	–	cgr
Circl	CVE-2025-29775	14 Mar 202517:49	–	circl
CNNVD	xml-crypto 数据伪造问题漏洞	14 Mar 202500:00	–	cnnvd
CVE	CVE-2025-29775	14 Mar 202517:11	–	cve
GithubExploit	Exploit for CVE-2025-29775	17 Apr 202502:32	–	githubexploit
EUVD	EUVD-2025-7891	3 Oct 202520:07	–	euvd

[
  {
    "vendor": "node-saml",
    "product": "xml-crypto",
    "versions": [
      {
        "version": ">= 4.0.0, < 6.0.1",
        "status": "affected"
      },
      {
        "version": ">= 3.0.0, < 3.2.1",
        "status": "affected"
      },
      {
        "version": "< 2.1.6",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/node-saml/xml-crypto/commit/8ac6118ee7978b46aa56b82cbcaa5fca58c93a07
github	www.github.com/node-saml/xml-crypto/security/advisories/GHSA-x3m8-899r-f7c3
github	www.github.com/node-saml/xml-crypto/releases/tag/v6.0.1
github	www.github.com/node-saml/xml-crypto/releases/tag/v2.1.6
github	www.github.com/node-saml/xml-crypto/releases/tag/v3.2.1
github	www.github.com/node-saml/xml-crypto/commit/886dc63a8b4bb5ae1db9f41c7854b171eb83aa98
github	www.github.com/node-saml/xml-crypto/commit/28f92218ecbb8dcbd238afa4efbbd50302aa9aed

14 Mar 2025 17:11Current

CVSS 49.3

EPSS0.09378

CWE-347