Rothenberg discloses XSS and SQL injection flaws in Perl modules
November 7: oss-security said SQL::Abstract before 2.000003 allows SQL injection through an arrayref column value in insert and update, CVE-2026-121265. November 4 posts also covered three earlier SQL::Abstract issues.
oss-security posts describe unpatched-looking XSS and SQL injection flaws in several Perl modules, including a November 7 SQL::Abstract issue.
Robert Rothenberg posted on oss-security about flaws in Perl modules that render or interpolate values without proper escaping. Data::MuForm through 0.05 can place attribute values and option labels into HTML unescaped, and Web::Simple before 0.036 does not escape values interpolated into double-quoted strings in HTML::Tags output. SQL::Abstract from 1.90_01 before 2.000001_04 is described as allowing SQL injection via where values of a nested statement in an identifier position; SQL::Abstract::Tree before 2.000001_04 can expose XSS through unescaped SQL text and bind values in the html profile. A later post says SQL::Abstract before 2.000003 allows SQL injection via an arrayref column value in insert and update. The posts advise users to review updates or patches; exploitation is not reported.
- Data::MuForm through 0.05: CVE-2026-121632, unescaped HTML attribute values and option labels.
- Web::Simple before 0.036: CVE-2026-114627, unescaped values in HTML::Tags double-quoted strings.
- SQL::Abstract from 1.90_01 before 2.000001_04: SQLi via nested where values in identifier position.
- SQL::Abstract::Tree before 2.000001_04: XSS via unescaped SQL text and bind values in html profile.
- November 4 posts list CVE-2026-121007, CVE-2026-121008, and CVE-2026-121009; a third issue description is truncated.
- SQL::Abstract before 2.000003: CVE-2026-121265, SQLi via arrayref column values in insert and update.
Timeline
dated events in the reporting · oldest first- Nov 4, 2026Data::MuForm XSS through 0.05 posted · oss-security
- Nov 4, 2026Web::Simple HTML::Tags escaping flaw posted · oss-security
- Nov 4, 2026Three SQL::Abstract injection and XSS issues posted · oss-security
- Nov 7, 2026SQL::Abstract arrayref insert/update SQLi posted · oss-security
What each outlet adds
beyond the shared facts- oss-securityNames Data::MuForm, Web::Simple, and SQL::Abstract version ranges and CVE ids.
Coverage
oldest first · one row per article · UTC- · 7d ago
oss-securityFirst report
Perl Data::MuForm Module Has Unescaped HTML Rendering Vulnerability
Data::MuForm versions through 0.05 render attribute values and option labels into HTML without escaping, risking XSS.
- · 7d ago
Web::Simple before 0.036 for Perl does not escape values interpolated into double-quoted strings in HTML::Tags output…
The versions before 0.036 do not escape values interpolated into double-quoted strings in HTML::Tags output.
- · 7d ago
SQL::Abstract and SQL::Abstract::Tree before 2.000001_04 for Perl allow SQL injection and XSS (CVE-2026-121007,…
Versions before 2.000001_04 allow SQL injection via where values in identifier position and XSS via unescaped SQL text and bind values.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114627 | XSS in Web::Simple before 0.036 for Perl | 6.1 | — | ||
| CVE-2026-121007 | SQL injection in SQL::Abstract before 2.000001_04 | 7.3 | — | ||
CVE-2026-121009+1 related CVE | SQL Injection in SQL::Abstract before 2.000001_04 | 7.3 group max | — | ||
| CVE-2026-121265 | SQL Injection in SQL::Abstract before 2.000003 | 9.8 | <1% | PoC | |
| CVE-2026-121632 | XSS in Data::MuForm through 0.05 | 6.1 | — |