Is CVE-2025-29775 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-29775 being exploited in the wild.

How severe is CVE-2025-29775?

Medium severity, with a CVSS score of 4, published 14 March 2025.

Which products and versions are affected?

xml-crypto (npm) SEMVER:introduced=4.0.0,fixed=6.0.1.

Is there a fix for CVE-2025-29775?

Yes. xml-crypto (npm): upgrade to 6.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-29775 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-29775?

Check whether you run xml-crypto (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-29775: xml-crypto XML Signature Verification Bypass via DigestValue Comment

CVE-2025-29775 · Severity: medium · CVSS 4 · Published 2025-03-14

xml-crypto is a widely-used Node.js library for validating digitally signed XML documents, commonly used in SAML-based authentication systems. A vulnerability allows attackers to inject comments into XML digest values, causing signature verification to pass for tampered documents. This could enable account takeover, privilege escalation, or impersonation by modifying authentication tokens or access control attributes while maintaining valid signatures.

Technologies: xml-crypto (npm). Vendors: npm.

Quick answers

Is CVE-2025-29775 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-29775 being exploited in the wild.
How severe is CVE-2025-29775?: Medium severity, with a CVSS score of 4, published 14 March 2025.
Which products and versions are affected?: xml-crypto (npm) SEMVER:introduced=4.0.0,fixed=6.0.1.
Is there a fix for CVE-2025-29775?: Yes. xml-crypto (npm): upgrade to 6.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-29775 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-29775?: Check whether you run xml-crypto (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

xml-crypto (npm): upgrade to 6.0.1 or later
```
npm install xml-crypto@6.0.1
```

Technical details

The vulnerability is an improper cryptographic signature verification issue (CWE-347) affecting xml-crypto versions ≤6.0.0. The root cause is insufficient validation of the DigestValue element structure during XML signature verification; attackers can inject XML comments into DigestValue nodes, which are then included in the digest calculation, allowing a modified document to pass signature checks. The attack requires network access to supply a crafted XML payload to an application using xml-crypto, with no authentication or user interaction required. An attacker can modify signed XML messages (such as SAML responses) to alter identity or authorization attributes while preserving cryptographic validity. Patches are available in version 6.0.1 (main line), 3.2.1 (v3.x), and 2.1.6 (v2.x).

Affected products

node-saml xml-crypto ≤6.0.0 (fixed in 6.0.1, 3.2.1, 2.1.6)

Identifiers

CVE-2025-29775
GHSA-x3m8-899r-f7c3

Timeline

2025-03-14: disclosed
2025-03-14: patched

References

https://github.com/node-saml/xml-crypto/security/advisories/GHSA-x3m8-899r-f7c3

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.