CVE-2025-29775

A flaw was found in the xml-crypto library for Node.js. An attacker can exploit this vulnerability to bypass authentication or authorization mechanisms in systems that rely on xml-crypto to verify signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a...

CVE-2025-29774

A flaw was found in the xml-crypto library for Node.js. An attacker can exploit this vulnerability to bypass authentication or authorization mechanisms in systems that rely on xml-crypto to verify signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a...

CVE-2025-25940

VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java...

[SECURITY] Fedora 42 Update: libxml2-2.12.10-1.fc42

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

[SECURITY] Fedora 42 Update: python-jinja2-3.1.6-1.fc42

Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. If you have any exposure to other text-based template languages, such as Smarty or Django, you should feel right at home with...

CVE-2025-29775

xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. Th...

@alexssmusica/emissao-nota-fiscal (>=1.0.0, <=1.0.5), @borodutch-labs/in-app-purchase (1.13.2) +12 more potentially affected by CVE-2025-29775 via xml-crypto (>=2.0.0, <=2.1.5)

xml-crypto NPM version =2.0.0, =1.0.0, =0.1.0-beta.57, =0.2.1-beta.36, =1.14.0, =1.12.1, =0.7.1, =0.0.1, =0.0.9 Source cves: CVE-2025-29775 Source advisory: OSV:GHSA-X3M8-899R-F7C3...

@boxyhq/saml-jackson (>=1.11.2, <=1.40.2), @boxyhq/saml20 (>=1.2.4, <=1.8.0) +8 more potentially affected by CVE-2025-29775 via xml-crypto (>=4.1.0, <=6.0.0)

xml-crypto NPM version =4.1.0, =1.11.2, =1.2.4, =1.0.0-beta, =4.0.0, =1.0.0, =0.0.1, =0.0.2 - saml-nofs 3.0.2 - verifactu-utils 1.1.0 Source cves: CVE-2025-29775 Source advisory: OSV:GHSA-X3M8-899R-F7C3...

@boxyhq/saml-jackson (>=1.3.2, <=1.11.1), @boxyhq/saml20 (>=1.0.11, <=1.2.3) +4 more potentially affected by CVE-2025-29775 via xml-crypto (>=3.0.0, <=3.2.0)

xml-crypto NPM version =3.0.0, =1.3.2, =1.0.11, =1.13.3, =1.13.5, =2.1.0, =1.0.0, =1.0.1 Source cves: CVE-2025-29775 Source advisory: OSV:GHSA-X3M8-899R-F7C3...

xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

Impact An attacker may be able to exploit this vulnerability to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature...

CVE-2025-29774

xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. Th...

@boxyhq/saml-jackson (>=1.3.2, <=1.11.1), @boxyhq/saml20 (>=1.0.11, <=1.2.3) +4 more potentially affected by CVE-2025-29774 via xml-crypto (>=3.0.0, <=3.2.0)

xml-crypto NPM version =3.0.0, =1.3.2, =1.0.11, =1.13.3, =1.13.5, =2.1.0, =1.0.0, =1.0.1 Source cves: CVE-2025-29774 Source advisory: OSV:GHSA-9P8X-F768-WP2G...

GHSA-9P8X-F768-WP2G xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

Impact An attacker may be able to exploit this vulnerability to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature...

xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

Impact An attacker may be able to exploit this vulnerability to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature...

@boxyhq/saml-jackson (>=1.11.2, <=1.40.2), @boxyhq/saml20 (>=1.2.4, <=1.8.0) +8 more potentially affected by CVE-2025-29774 via xml-crypto (>=4.1.0, <=6.0.0)

xml-crypto NPM version =4.1.0, =1.11.2, =1.2.4, =1.0.0-beta, =4.0.0, =1.0.0, =0.0.1, =0.0.2 - saml-nofs 3.0.2 - verifactu-utils 1.1.0 Source cves: CVE-2025-29774 Source advisory: OSV:GHSA-9P8X-F768-WP2G...

@alexssmusica/emissao-nota-fiscal (>=1.0.0, <=1.0.5), @borodutch-labs/in-app-purchase (1.13.2) +12 more potentially affected by CVE-2025-29774 via xml-crypto (>=2.0.0, <=2.1.5)

xml-crypto NPM version =2.0.0, =1.0.0, =0.1.0-beta.57, =0.2.1-beta.36, =1.14.0, =1.12.1, =0.7.1, =0.0.1, =0.0.9 Source cves: CVE-2025-29774 Source advisory: OSV:GHSA-9P8X-F768-WP2G...

CVE-2025-29775 xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. Th...

CVE-2025-29775 xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. Th...

CVE-2025-29775 xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. Th...

CVE-2025-29775

CVE-2025-29775 : The xml-crypto library for Node.js is vulnerable in versions prior to 6.0.1, 3.2.1, and 2.1.6. An attacker can modify a valid signed XML message in transit such that signature verification still passes, bypassing authentication/authorization checks and enabling privilege escalati...