Is CVE-2025-29774 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-29774 being exploited in the wild.

How severe is CVE-2025-29774?

Medium severity, with a CVSS score of 4, published 14 March 2025.

Which products and versions are affected?

xml-crypto (npm) SEMVER:introduced=4.0.0,fixed=6.0.1.

Is there a fix for CVE-2025-29774?

Yes. xml-crypto (npm): upgrade to 6.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-29774 attacked?

It is attacked over the network.

Am I affected by CVE-2025-29774?

Check whether you run xml-crypto (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-29774: xml-crypto XML signature verification bypass via multiple SignedInfo references

CVE-2025-29774 · Severity: medium · CVSS 4 · Published 2025-03-14

xml-crypto is a library used to verify digitally signed XML documents, which are commonly used in authentication systems like SAML. An attacker can exploit this vulnerability to forge or modify signed XML messages in ways that still pass verification checks, potentially allowing them to escalate privileges, bypass access controls, or impersonate other users in systems that depend on XML signature validation.

Technologies: xml-crypto (npm). Vendors: npm.

Quick answers

Is CVE-2025-29774 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-29774 being exploited in the wild.
How severe is CVE-2025-29774?: Medium severity, with a CVSS score of 4, published 14 March 2025.
Which products and versions are affected?: xml-crypto (npm) SEMVER:introduced=4.0.0,fixed=6.0.1.
Is there a fix for CVE-2025-29774?: Yes. xml-crypto (npm): upgrade to 6.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-29774 attacked?: It is attacked over the network.
Am I affected by CVE-2025-29774?: Check whether you run xml-crypto (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

xml-crypto (npm): upgrade to 6.0.1 or later
```
npm install xml-crypto@6.0.1
```

Technical details

The vulnerability is an improper cryptographic signature verification issue (CWE-347) affecting xml-crypto versions 6.0.0 and earlier. An attacker can inject multiple SignedInfo elements within a single Signature node—the verification logic processes only one while an attacker crafts a forged reference with a fake digest value in a nested SignedInfo element. This allows the attacker to modify signed XML documents (e.g., SAML assertions) while the signature still validates. The attack requires network access to send modified signed XML payloads but no authentication or special privileges. Patches are available: version 6.0.1 for v6.x, 3.2.1 for v3.x, and 2.1.6 for v2.x.

Affected products

xml-crypto xml-crypto <=6.0.0

Identifiers

CVE-2025-29774
GHSA-9p8x-f768-wp2g

Timeline

2025-03-14: disclosed
2025-03-14: patched: Version 6.0.1, 3.2.1, 2.1.6 released

References

https://github.com/node-saml/xml-crypto/security/advisories/GHSA-9p8x-f768-wp2g

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.