DEBIAN-CVE-2026-120648: Debian/libcgi-pm-perl vulnerability
CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment. Arguments are placed between <!-- and --> without escaping, so text containing --> closes the comment early. An application that passes request data to comment can be made to inject HTML into the page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CGI for Perlto a version that resolves this vulnerability.Fixed in 5.00
Event History
Frequently Asked Questions
What must an attacker control to exploit this issue?
An attacker must be able to supply request data, or other input, that the application passes to CGI's comment handling. The supplied text must contain --> to terminate the generated HTML comment early and inject HTML.
Are all applications using libcgi-pm-perl affected?
No. An application is affected when it passes untrusted request data to the comment functionality. The provided information does not establish whether any particular default application configuration does this.
How can I determine whether an application is exposed?
Review application code for uses of CGI comment generation that include request-derived or otherwise untrusted data. Test whether input containing --> is emitted between <!-- and --> without escaping and causes subsequent text to be interpreted as HTML.