{"action":"Upgrade robrichards/xmlseclibs to 3.1.4 or later.","affected":[{"fixed":"3.1.4","introduced":"0"}],"component":"robrichards/xmlseclibs","cve_ids":["CVE-2025-66578"],"ecosystem":"Packagist","epss":0.00242,"exploited":false,"fixed_versions":["3.1.4"],"ghsa_id":"GHSA-c4cc-x928-vjw9","id":"tcs_01M5KF0JBW0RV3W77H8YT0Y8HH","modified_at":"2025-12-09T19:52:24.819272Z","published_at":"2025-12-08T17:57:33Z","references":["https://osv.dev/vulnerability/GHSA-c4cc-x928-vjw9","https://github.com/robrichards/xmlseclibs/security/advisories/GHSA-c4cc-x928-vjw9","https://nvd.nist.gov/vuln/detail/CVE-2025-66578","https://github.com/robrichards/xmlseclibs/commit/69fd63080bc47a8d51bc101c30b7cb756862d1d6","https://github.com/robrichards/xmlseclibs","https://github.com/robrichards/xmlseclibs/blob/f4131320c6dcd460f1b0c67f16f8bf24ce4b5c3e/src/XMLSecurityDSig.php#L296"],"severity":{"label":"medium","score":6},"sources":[{"source":"osv","source_id":"GHSA-c4cc-x928-vjw9","url":"https://osv.dev/vulnerability/GHSA-c4cc-x928-vjw9"}],"summary":"robrichards/xmlseclibs has an Libxml2 Canonicalization error which can bypass Digest/Signature validation"}