CVE-2026-120212

not scored yet · published 2026-11-10

Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output. HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected. An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.

Weakness: CWE-79

Source: NVD CVE-2026-120212

References

• https://github.com/p5sagit/Web-Simple/commit/de0b7743f7015ec2c1c678dfdaa4bc6f5ccfb640.patch
• https://metacpan.org/release/ETHER/Web-Simple-0.037/changes
• https://www.cve.org/CVERecord?id=CVE-2026-5090

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.