The issue is just that - the @ is being interpreted as a global symbol and it should behave as a XPATH symbol signifying the attribute.

my $query = "/nvd/entry[@id = $cve_id]";

my $xp = XML::XPath-> new(filename => "$data_file");

foreach my $cve_entry ($xp->findnodes($query)) {
}
[download]

You need to escape the @ somehow so perl does not try to interpolate it:

my $query = '/nvd/entry[@id = ' . $cve_id . ']';
[download]

or

my $query = "/nvd/entry[\@id = $cve_id]";
[download]

-derby

... which is what both use strict; and use warnings; would have told you, if you had used them.