CVE-2026-120643: CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url

Q: Which applications are exposed to this issue?

Applications using Perl CGI versions 4.62 through versions before 5.00 are exposed only if they use url or self_url and place the returned URL into a single-quoted HTML attribute or a single-quoted JavaScript string.

Q: What does an attacker need to exploit it?

An attacker needs to be able to send a request containing an apostrophe in the request path or in a parameter, and the application must reflect the URL returned by url or self_url in an affected single-quoted context.

Q: How can I identify potentially vulnerable code?

Review uses of CGI's url and self_url methods. Flag cases where their output is inserted into single-quoted HTML attributes or JavaScript strings, particularly when the resulting URL is based on an attacker-controlled request path or parameter.

Q: What can be done if upgrading is not immediately possible?

Avoid placing output from url or self_url directly into single-quoted HTML attributes or JavaScript strings. Apply context-appropriate escaping before rendering the returned URL.

Published Nov 3, 2026

Updated

CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and selfurl.

Both pass the URL through URI's canonical method, which leaves an apostrophe in the path raw and decodes the %27 that query parameter escaping produces, so an apostrophe in the request path or a parameter appears raw in the result.

An application that places the URL in a single-quoted HTML attribute or JavaScript string is open to cross-site scripting.

Affected Software

4 affected components

debian/libcgi-pm-perl*

debian/libcgi-pm-perl<=4.55-1, <=4.68-1, <=4.72-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CGI for Perl to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 3, 2026

CVE Published

via MITRE·11:40 PM

Data Sourced

via MITRE·11:40 PM

RemedyDescriptionWeakness

Nov 4, 2026

Data Sourced

via NVD·12:17 AM

DescriptionWeakness

Data Sourced

via OSV·12:17 AM

DescriptionAffected Software

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using Perl CGI versions 4.62 through versions before 5.00 are exposed only if they use url or self_url and place the returned URL into a single-quoted HTML attribute or a single-quoted JavaScript string.

What does an attacker need to exploit it?

An attacker needs to be able to send a request containing an apostrophe in the request path or in a parameter, and the application must reflect the URL returned by url or self_url in an affected single-quoted context.

How can I identify potentially vulnerable code?

Review uses of CGI's url and self_url methods. Flag cases where their output is inserted into single-quoted HTML attributes or JavaScript strings, particularly when the resulting URL is based on an attacker-controlled request path or parameter.

What can be done if upgrading is not immediately possible?

Avoid placing output from url or self_url directly into single-quoted HTML attributes or JavaScript strings. Apply context-appropriate escaping before rendering the returned URL.

CVE-2026-120643: CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

How can I identify potentially vulnerable code?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

How can I identify potentially vulnerable code?

What can be done if upgrading is not immediately possible?