Web::Simple before 0.036 for Perl does not escape values interpolated into double-quoted strings in HTML::Tags output…
The versions before 0.036 do not escape values interpolated into double-quoted strings in HTML::Tags output.
30
Vulnerability1 · 1 read
CVE-2026-114627
XSS in Web::Simple before 0.036 for Perl
- CVSS 3.1
- 6.1 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags or XML::Tags output. An attacker controlling an interpolated value can inject scripts into generated pages. Users of affected Web::Simple versions are exposed.
What to do: Upgrade to Web::Simple 0.036. No workaround named.
| Product | Affected | Fixed in |
|---|---|---|
| Perl Web::Simple | before 0.036 | 0.036 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output. Under use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step passes such objects through, and stringify joins their interpolated parts as is. A value passed on its own, as in , $value, , is entity-escaped, but the same value in "Hello $value" is not. An attacker who controls a value that an application interpolates into a double-quoted string can inject script into the generated page.
- Weakness
- CWE-79
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N