CVE-2026-120648: CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment

Q: Which applications are exposed to this issue?

Applications using Perl CGI versions before 5.00 are exposed only when they pass request-controlled data to the comment function. The unsafe behavior occurs because comment arguments are inserted between HTML comment delimiters without escaping.

Q: What must an attacker control to exploit it?

An attacker needs to supply input that the application passes to comment, including text containing -->. That sequence closes the generated HTML comment early and allows subsequent attacker-controlled content to be interpreted as HTML.

Published Nov 3, 2026

Updated

CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment.

Arguments are placed between  without escaping, so text containing --> closes the comment early.

An application that passes request data to comment can be made to inject HTML into the page.

Affected Software

4 affected components

debian/libcgi-pm-perl*

debian/libcgi-pm-perl<=4.55-1, <=4.68-1, <=4.72-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CGI for Perl to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 3, 2026

CVE Published

via MITRE·11:41 PM

Data Sourced

via MITRE·11:41 PM

RemedyDescriptionWeakness

Data Sourced

via OSV·11:41 PM

DescriptionWeakness

Nov 4, 2026

Data Sourced

via NVD·12:17 AM

DescriptionWeakness

Data Sourced

via OSV·12:17 AM

Affected Software

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using Perl CGI versions before 5.00 are exposed only when they pass request-controlled data to the comment function. The unsafe behavior occurs because comment arguments are inserted between HTML comment delimiters without escaping.

What must an attacker control to exploit it?

An attacker needs to supply input that the application passes to comment, including text containing -->. That sequence closes the generated HTML comment early and allows subsequent attacker-controlled content to be interpreted as HTML.

Are applications safe if they do not use request data in comments?

Based on the available information, the injection requires an application to pass request data to comment. Applications that do not place attacker-controlled request data in comment arguments are not described as affected by this exploit path.

What can be done if upgrading is not immediately possible?

Do not pass request-controlled data to comment. Remove such data from generated comments or ensure it cannot contain the --> sequence before it is passed to the function.

CVE-2026-120648: CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What must an attacker control to exploit it?

Are applications safe if they do not use request data in comments?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What must an attacker control to exploit it?

Are applications safe if they do not use request data in comments?

What can be done if upgrading is not immediately possible?