Vulnerability · Published Mar 14, 2025 · Assigned by GitHub_M
CVE-2025-29775xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment
Critical 9.3
In plain English
A critical-severity security flaw in xml-crypto from node-saml. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 10.1% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature verification checks. For example, it could be used to alter critical identity or access control attributes, enabling an attacker to escalate privileges or impersonate another user. Users of versions 6.0.0 and prior should upgrade to version 6.0.1 to receive a fix. Those who are still using v2.x or v3.x should upgrade to patched versions 2.1.6 or 3.2.1, respectively.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | xml-crypto | 6.0.1 | GHSA-x3m8-899r-f7c3 |
| npm | xml-crypto | 3.2.1 | GHSA-x3m8-899r-f7c3 |
| npm | xml-crypto | 2.1.6 | GHSA-x3m8-899r-f7c3 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| node-saml | xml-crypto | >= 4.0.0, < 6.0.1>= 3.0.0, < 3.2.1< 2.1.6 |
Weakness: CWE-347 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/node-saml/xml-crypto/security/advisories/GHSA-x3m8-899r-f7c3 x_refsource_CONFIRM
- https://github.com/node-saml/xml-crypto/commit/28f92218ecbb8dcbd238afa4efbbd50302aa9aed x_refsource_MISC
- https://github.com/node-saml/xml-crypto/commit/886dc63a8b4bb5ae1db9f41c7854b171eb83aa98 x_refsource_MISC
- https://github.com/node-saml/xml-crypto/commit/8ac6118ee7978b46aa56b82cbcaa5fca58c93a07 x_refsource_MISC
- https://github.com/node-saml/xml-crypto/releases/tag/v2.1.6 x_refsource_MISC
- https://github.com/node-saml/xml-crypto/releases/tag/v3.2.1 x_refsource_MISC
- https://github.com/node-saml/xml-crypto/releases/tag/v6.0.1 x_refsource_MISC
- https://workos.com/blog/samlstorm