What is CVE-2026-9390?

CVE-2026-9390 is a critical-severity vulnerability in Timlegge Xml::sig, classified under Improper Neutralization of Data within XPath Expressions (XPath Injection). CVSS score: 9.1/10. Published 2026-08-03.

How severe is CVE-2026-9390?

Critical severity. CVSS v3 base score is 9.1 out of 10.

XPath Injection in Timlegge Xml::sig

CVE-2026-9390

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified…

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Timlegge Xml::sig — versions 0

Weakness classification (CWE)

CWE-643 — Improper Neutralization of Data within XPath Expressions (XPath Injection)
CWE-1287

References

9b29abf9-4ab0-4765-b253-1875cd9b441e (patch)
9b29abf9-4ab0-4765-b253-1875cd9b441e (patch)
9b29abf9-4ab0-4765-b253-1875cd9b441e (release-notes)

Frequently asked questions

What is CVE-2026-9390?: CVE-2026-9390 is a critical-severity vulnerability in Timlegge Xml::sig, classified under Improper Neutralization of Data within XPath Expressions (XPath Injection). CVSS score: 9.1/10. Published 2026-08-03.
How severe is CVE-2026-9390?: Critical severity. CVSS v3 base score is 9.1 out of 10.