You need to escape the @ somehow so perl does not try to interpolate it:

my $query = '/nvd/entry[@id = ' . $cve_id . ']';
[download]

my $query = "/nvd/entry[\@id = $cve_id]";
[download]