CVE-2026-114627: Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output
Web::Simple versions before 0.036 for Perl do not escape values interp ...
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Web::Simpleto a version that resolves this vulnerability.Fixed in 0.036
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Web::Simple with HTML::Tags or XML::Tags are exposed when they place attacker-controlled values inside double-quoted interpolated string literals that are rendered into HTML. Values emitted as standalone elements are entity-escaped and are not affected by the described behavior.
What does an attacker need to exploit it?
An attacker needs control over a value that the application interpolates into a double-quoted string, such as "Hello $value", in HTML::Tags or XML::Tags output. That value can then be used to inject script into the generated page.
What version addresses the issue?
Web::Simple 0.036 addresses this issue. Versions before 0.036 are affected.