Web::Simple before 0.037 fails to escape single quotes
Original title: CVE-2026-120212: Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output
An oss-security post says HTML::Tags output from the Perl module leaves single quotes unescaped.
Robert Rothenberg posted to oss-security about CVE-2026-120212 in the Perl module Web::Simple. Versions before 0.037 do not escape single quotes in HTML::Tags output. The available feed text is only a short notice and does not describe impact, exploitation, or a patch.
Unconfirmed: The snippet does not state a fixed version or whether the issue is exploited.
- The notice was posted on November 10.
- It points to the Web::Simple distribution on MetaCPAN.
Impact: Single quotes left unescaped in HTML output
| Product | Affected |
|---|---|
| Web::Simple | before 0.037 |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-120212 | XSS via unescaped single quotes in Perl Web::Simple before 0.037 | — | — |
From the original article
Posted by Robert Rothenberg on Nov 10 ======================================================================== https://metacpan. org/dist/Web-Simple VCS Repo: ...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.