Web::Simple before 0.037 fails to escape single quotes
An oss-security post says HTML::Tags output from the Perl module leaves single quotes unescaped.
38
CVE-2026-120212
XSS via unescaped single quotes in Perl Web::Simple before 0.037
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Web::Simple before 0.037 for Perl does not escape single quotes in HTML::Tags and XML::Tags output. Those helpers only replace & and " in plain string values. An attacker who controls a value that an application interpolates into a single-quoted attribute can close the attribute, add others such as an event handler, and inject script into the generated page. Double-quoted attributes are not affected. Applications that emit attacker-controlled data only in double-quoted attributes are not exposed by this flaw.
What to do: Upgrade Web::Simple to 0.037. Until then, avoid interpolating untrusted values into single-quoted attributes; double-quoted attributes are not affected.
| Product | Affected | Fixed in |
|---|---|---|
| Web::Simple | before 0.037 | 0.037 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output. HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", with entities. A value interpolated into a single-quoted attribute, as in , can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected. An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.
- Weakness
- CWE-79