# XPath Injection

> Detects XPath queries built from user input without escaping, enabling authentication bypass and data disclosure.

- Skill: `zakirkun/xpath-injection` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/xpath-injection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/xpath-injection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/xpath-injection

---


# XPath Injection

## Overview
XPath injection is analogous to SQL injection but targets XML documents. An attacker can manipulate XPath expressions to bypass authentication, access unauthorized data nodes, or cause denial of service.

Classic bypass: `' or '1'='1` in username field when query is `//user[name/text()='{username}']`

## Remediation
Use parameterized XPath (XQuery with bound variables) or escape user input using library-provided escaping functions.

**Vulnerable (Java):**
```java
String query = "//user[name='" + username + "' and password='" + password + "']";
NodeList nodes = (NodeList) xpath.evaluate(query, doc, XPathConstants.NODESET);
```

**Safe (Java):**
```java
// Use parameterized XQuery or properly escape the input
```