{"action":"Upgrade xml-crypto to 6.0.0 or later.","affected":[{"fixed":"6.0.0","introduced":"4.0.0"}],"component":"xml-crypto","cve_ids":["CVE-2024-32962"],"ecosystem":"npm","epss":0.00833,"exploited":false,"fixed_versions":["6.0.0"],"ghsa_id":"GHSA-2xp3-57p7-qf4v","id":"tcs_01M5KEVEY5200S2R5AX2VZ6WD6","modified_at":"2026-09-10T03:50:12.986760516Z","published_at":"2024-05-01T17:05:53Z","references":["https://osv.dev/vulnerability/GHSA-2xp3-57p7-qf4v","https://github.com/node-saml/xml-crypto/security/advisories/GHSA-2xp3-57p7-qf4v","https://nvd.nist.gov/vuln/detail/CVE-2024-32962","https://github.com/node-saml/xml-crypto/pull/301","https://github.com/node-saml/xml-crypto/pull/445","https://github.com/node-saml/xml-crypto/commit/21201723d2ca9bc11288f62cf72552b7d659b000","https://github.com/node-saml/xml-crypto/commit/c2b83f984049edb68ad1d7c6ad0739ec92af11ca","https://github.com/node-saml/xml-crypto","https://github.com/node-saml/xml-crypto/discussions/399","https://security.netapp.com/advisory/ntap-20240705-0003","https://www.w3.org/TR/2008/REC-xmldsig-core-20080610/#sec-CoreValidation"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-2xp3-57p7-qf4v","url":"https://osv.dev/vulnerability/GHSA-2xp3-57p7-qf4v"}],"summary":"xml-crypto vulnerable to XML signature verification bypass due improper verification of signature/signature spoofing"}