Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

Web::Simple before 0.036 for Perl does not escape values interpolated into double-quoted strings in HTML::Tags output…

Original title: CVE-2026-114627: Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output

oss-security ()1
Read at seclists.org
Part of a story covered by 3 sourcesRothenberg discloses XSS and SQL injection flaws in Perl modulesMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

The versions before 0.036 do not escape values interpolated into double-quoted strings in HTML::Tags output.

Robert Rothenberg posted details on oss-security about CVE-2026-114627 in Web::Simple versions before 0.036 for Perl that do not escape values interpolated into double-quoted strings in HTML::Tags output.

Key facts
  • CVE-2026-114627
  • Affected: Web::Simple
Analyze CVE-2026-114627 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-114627
Tags
web-simpleperlxss
Vendors
Perl
Products
Web::Simple

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-114627
XSS in Web::Simple before 0.036 for Perl
6.1—

From the original article

Posted by Robert Rothenberg on Nov 04 ======================================================================== https://metacpan. org/dist/Web-Simple VCS Repo: ...

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.