xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

🗓️ 14 Mar 2025 17:16:47Reported by GitHub Advisory DatabaseType

xml-crypto vulnerability allows bypass of XML signature verification enabling attacks on systems.

Reporter	Title	Published	Views	Family All 26
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js modules axios and xml-crypto (CVE-2025-27152, CVE-2025-29774, CVE-2025-29775 and CVE-2024-57965)	16 Apr 202515:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to Improper Verification of Cryptographic Signature due to xml-crypto ( CVE-2025-29774, CVE-2025-29775 )	20 Jun 202506:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to bypass signature validation in XML data [CVE-2025-29774] [CVE-2025-29775]	8 May 202517:57	–	ibm
Chainguard	CVE-2025-29775 vulnerabilities	17 Mar 202522:12	–	cgr
Circl	CVE-2025-29775	14 Mar 202517:49	–	circl
CNNVD	xml-crypto 数据伪造问题漏洞	14 Mar 202500:00	–	cnnvd
CVE	CVE-2025-29775	14 Mar 202517:11	–	cve
Cvelist	CVE-2025-29775 xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment	14 Mar 202517:11	–	cvelist
GithubExploit	Exploit for CVE-2025-29775	17 Apr 202502:32	–	githubexploit
EUVD	EUVD-2025-7891	3 Oct 202520:07	–	euvd

Vulners

Node

xml-cryptoRange<2.1.6npm

xml-cryptoRange3.0.0–3.2.1npm

xml-cryptoRange4.0.0–6.0.1npm

Source	Link
github	www.github.com/node-saml/xml-crypto/security/advisories/GHSA-x3m8-899r-f7c3
github	www.github.com/node-saml/xml-crypto/commit/28f92218ecbb8dcbd238afa4efbbd50302aa9aed
github	www.github.com/node-saml/xml-crypto/commit/886dc63a8b4bb5ae1db9f41c7854b171eb83aa98
github	www.github.com/node-saml/xml-crypto/commit/8ac6118ee7978b46aa56b82cbcaa5fca58c93a07
github	www.github.com/node-saml/xml-crypto/releases/tag/v2.1.6
github	www.github.com/node-saml/xml-crypto/releases/tag/v3.2.1
github	www.github.com/node-saml/xml-crypto/releases/tag/v6.0.1
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-29775
workos	www.workos.com/blog/samlstorm
github	www.github.com/advisories/GHSA-x3m8-899r-f7c3

16 Mar 2025 21:34Current

7High risk

Vulners AI Score7

CVSS 49.3

EPSS0.00197

SSVC