Web::Simple before 0.037 fails to escape single quotes
An oss-security post says HTML::Tags output from the Perl module leaves single quotes unescaped.
38
Product
Web::Simple
- Mentions · 7d1
- Mentions · 30d3
- All mentions3
- First seenOct 24, 2026
- Last mentioned1d ago
Timeline
3 articles · newest firstWeb::Simple before 0.036 for Perl does not escape values interpolated into double-quoted strings in HTML::Tags output…
The versions before 0.036 do not escape values interpolated into double-quoted strings in HTML::Tags output.
30
Web::Simple before 0.035 sizes a buffer from Content-Length (CVE-2026-114629)
Robert Rothenberg posted the Perl module issue on October 24; the snippet does not mention attacks.
42
Related CVEs
by mentions- Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters
- XSS in Web::Simple before 0.036 for Perl
- XSS via unescaped single quotes in Perl Web::Simple before 0.037
Appears with
- Perlvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.