CVE-2026-9390

CVE-2026-9390 affects XML::Sig (Perl) versions before 0.71. The issue arises when verify()/_get_signed_xml() build XPath expressions by concatenating SignedInfo/Reference/@URI from the document without escaping or enforcing NCName rules. A URI containing a single quote can terminate the string li...

CVE-2026-9487

CVE-2026-9487 affects XML::Sig for Perl up to version 0.70. The vulnerability arises because _get_signed_xml() resolves IDs with the XPath //*[@ID='$id'] and accepts two elements sharing the same ID, causing signature wrapping: the digest and signature are validated against the first element in d...