xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature verification checks. For example, it could be used to alter critical identity or access control attributes, enabling an attacker to escalate privileges or impersonate another user. Users of versions 6.0.0 and prior should upgrade to version 6.0.1 to receive a fix. Those who are still using v2.x or v3.x should upgrade to patched versions 2.1.6 or 3.2.1, respectively.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to
    exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or
    authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The
    vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature
    verification checks. For example, it could be used to alter critical identity or access control
    attributes, enabling an attacker to escalate privileges or impersonate another user. Users of versions
    6.0.0 and prior should upgrade to version 6.0.1 to receive a fix. Those who are still using v2.x or v3.x
    should upgrade to patched versions 2.1.6 or 3.2.1, respectively. (CVE-2025-29775)

ID	Name	Product	Family	Type	Severity
421128	SCA: security update for xml-crypto (GHSA-x3m8-899r-f7c3)	Tenable Cloud Security	SCA Checks	Local	critical
421128	SCA: security update for xml-crypto (GHSA-x3m8-899r-f7c3)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2025-29775

critical

Tenable Plugins

critical

critical