CVE-2025-25291: Ruby Saml Rexml Xpath On Raw Document With Signed Element Id
SAML signature-validation pipeline re-queries the raw XML document with REXML::XPath using `signed_element_id` as the `@ID` lookup variable to fetch downstream identity content (NameID, Attributes, Subject, etc.). The cryptographic signature was verified by Nokogiri on a (potentially) different document tree; trusting REXML's ID-based lookup on the raw docum
greprules fetch cve-2025-25291-ruby-saml-rexml-xpath-on-raw-document-with-signed-element-id --engine opengrepDescription
SAML signature-validation pipeline re-queries the raw XML document with REXML::XPath using `signed_element_id` as the `@ID` lookup variable to fetch downstream identity content (NameID, Attributes, Subject, etc.). The cryptographic signature was verified by Nokogiri on a (potentially) different document tree; trusting REXML's ID-based lookup on the raw docum
Detection target
Not provided
Recommended fix
Not provided
False-positive notes
Not provided
Community feedback
Sign in to report false positives, mark this rule useful, or suggest metadata improvements.