{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-23T20:43:22.465","vulnerabilities":[{"cve":{"id":"CVE-2025-29774","sourceIdentifier":"security-advisories@github.com","published":"2025-03-14T17:15:52.870","lastModified":"2026-06-17T09:05:38.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature verification checks. For example, it could be used to alter critical identity or access control attributes, enabling an attacker with a valid account to escalate privileges or impersonate another user. Users of versions 6.0.0 and prior should upgrade to version 6.0.1 to receive a fix. Those who are still using v2.x or v3.x should upgrade to patched versions 2.1.6 or 3.2.1, respectively."},{"lang":"es","value":"xml-crypto es una librería de firma digital y cifrado XML para Node.js. Un atacante podría explotar una vulnerabilidad en versiones anteriores a la 6.0.1, 3.2.1 y 2.1.6 para eludir los mecanismos de autenticación o autorización en sistemas que dependen de xml-crypto para verificar documentos XML firmados. Esta vulnerabilidad permite a un atacante modificar un mensaje XML firmado válido de forma que aún supere las comprobaciones de verificación de firma. Por ejemplo, podría utilizarse para alterar atributos críticos de identidad o control de acceso, lo que permitiría a un atacante con una cuenta válida escalar privilegios o suplantar la identidad de otro usuario. Los usuarios de las versiones 6.0.0 y anteriores deben actualizar a la versión 6.0.1 para obtener una corrección. Quienes aún utilicen las versiones 2.x o 3.x deben actualizar a las versiones 2.1.6 o 3.2.1, respectivamente."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"node-saml","product":"xml-crypto","versions":[{"version":">= 4.0.0, < 6.0.1","status":"affected"},{"version":">= 3.0.0, < 3.2.1","status":"affected"},{"version":"< 2.1.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-03-14T18:36:19.111763Z","id":"CVE-2025-29774","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://github.com/node-saml/xml-crypto/commit/28f92218ecbb8dcbd238afa4efbbd50302aa9aed","source":"security-advisories@github.com"},{"url":"https://github.com/node-saml/xml-crypto/commit/886dc63a8b4bb5ae1db9f41c7854b171eb83aa98","source":"security-advisories@github.com"},{"url":"https://github.com/node-saml/xml-crypto/commit/8ac6118ee7978b46aa56b82cbcaa5fca58c93a07","source":"security-advisories@github.com"},{"url":"https://github.com/node-saml/xml-crypto/releases/tag/v2.1.6","source":"security-advisories@github.com"},{"url":"https://github.com/node-saml/xml-crypto/releases/tag/v3.2.1","source":"security-advisories@github.com"},{"url":"https://github.com/node-saml/xml-crypto/releases/tag/v6.0.1","source":"security-advisories@github.com"},{"url":"https://github.com/node-saml/xml-crypto/security/advisories/GHSA-9p8x-f768-wp2g","source":"security-advisories@github.com"},{"url":"https://workos.com/blog/samlstorm","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}