AZL-112783: CVE-2026-120648 affecting package perl-CGI 4.60-1

Q: Which applications are exposed to this issue?

Applications using affected CGI versions are exposed only if they pass request-controlled data to the comment function. The issue occurs when that data contains the sequence -->, which can terminate the generated HTML comment early.

Published Nov 4, 2026

Updated

CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment.

Arguments are placed between  without escaping, so text containing --> closes the comment early.

An application that passes request data to comment can be made to inject HTML into the page.

Affected Software

1 affected component

azure-linux/perl-cgi<=4.60-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade perl-CGI to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 4, 2026

Advisory Published

via OSV·12:17 AM

Data Sourced

via OSV·12:17 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-120648

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using affected CGI versions are exposed only if they pass request-controlled data to the comment function. The issue occurs when that data contains the sequence -->, which can terminate the generated HTML comment early.

What does an attacker need to exploit it?

An attacker needs to be able to supply text that the application places into a CGI comment. Supplying --> in that text can allow HTML to be injected into the resulting page.

How can I determine whether an application is affected?

Check whether it uses a CGI version earlier than 5.00 and whether request data is passed to the comment function. Review generated pages or relevant inputs for values containing -->.

What can be done if an immediate upgrade is not possible?

Do not pass request-controlled data to the comment function. In particular, prevent or remove --> from any text that may be placed between HTML comment delimiters.

AZL-112783: CVE-2026-120648 affecting package perl-CGI 4.60-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

How can I determine whether an application is affected?

What can be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

How can I determine whether an application is affected?

What can be done if an immediate upgrade is not possible?