CVE-2026-5090: Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected
Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected.
The htmlfilter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in
<a id='ref' title='[% var | html %]'>
would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example,
var = " ' onclick='while (true) { alert(1) }'"
Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Perl Template::Plugin::HTMLto a version that resolves this vulnerability.Fixed in 3.103Patch CVE-2026-5090
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5090?
CVE-2026-5090 is considered a medium severity vulnerability due to its potential for HTML and JavaScript injection.
How do I fix CVE-2026-5090?
To fix CVE-2026-5090, update Template::Plugin::HTML to version 3.103 or later where the vulnerability is addressed.
What versions are affected by CVE-2026-5090?
CVE-2026-5090 affects Template::Plugin::HTML versions up to and including 3.102.
What types of attacks can CVE-2026-5090 facilitate?
CVE-2026-5090 can facilitate Cross-Site Scripting (XSS) attacks through unescaped HTML and JavaScript injection.
Are there any workarounds for CVE-2026-5090?
There are no effective workarounds for CVE-2026-5090 other than updating to a secure version.