CVE-2026-120212: Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output

Q: Which applications are exposed to this issue?

Applications using Web::Simple before 0.037 are exposed only where HTML::Tags or XML::Tags output includes attacker-controlled data inside a single-quoted HTML attribute. Output placed in double-quoted attributes is not affected by this specific escaping gap.

Q: What must an attacker control to exploit it?

The attacker must be able to supply a value that the application interpolates into a single-quoted attribute, such as href='$value'. A single quote in that value can terminate the attribute and permit injection of additional attributes, including event handlers.

Q: How can I determine whether my application is affected?

Check whether it uses a Web::Simple version before 0.037 and review HTML::Tags or XML::Tags templates for single-quoted attributes containing variable values. Prioritize locations where those values can be influenced by untrusted users or external input.

Published Nov 10, 2026

Updated

Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output.

HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected.

An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.

Affected Software

1 affected component

cpan/Web-Simple<0.037

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Web::Simple to a version that resolves this vulnerability.
Fixed in 0.037

Event History

Nov 10, 2026

CVE Published

via MITRE·05:42 PM

Data Sourced

via MITRE·05:42 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·06:17 PM

DescriptionWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using Web::Simple before 0.037 are exposed only where HTML::Tags or XML::Tags output includes attacker-controlled data inside a single-quoted HTML attribute. Output placed in double-quoted attributes is not affected by this specific escaping gap.

What must an attacker control to exploit it?

The attacker must be able to supply a value that the application interpolates into a single-quoted attribute, such as href='$value'. A single quote in that value can terminate the attribute and permit injection of additional attributes, including event handlers.

How can I determine whether my application is affected?

Check whether it uses a Web::Simple version before 0.037 and review HTML::Tags or XML::Tags templates for single-quoted attributes containing variable values. Prioritize locations where those values can be influenced by untrusted users or external input.

CVE-2026-120212: Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What must an attacker control to exploit it?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What must an attacker control to exploit it?

How can I determine whether my application is affected?