Bypassing verification in the xml-crypto library, which has a million downloads per week.
A vulnerability (CVE-2024-32962) has been discovered in the xml-crypto JavaScript library, which is used as a dependency in 402 projects and downloaded from the NPM registry about a million times each week. The vulnerability has been assigned the maximum severity level (10 out of 10). The library provides functions for encrypting and verifying XML documents with digital signatures. This vulnerability allows an attacker to sign a fraudulent document that, by default configuration, will be accepted.
