UBUNTU-CVE-2026-120212: Medium severity ubuntu/libweb-simple-perl vulnerability
Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output. HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected. An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Web::Simpleto a version that resolves this vulnerability.Fixed in 0.037
Event History
Frequently Asked Questions
Which applications are exposed to script injection?
Applications using affected Web::Simple versions are exposed only when attacker-controlled data is interpolated into a single-quoted HTML attribute through HTML::Tags or XML::Tags output. Double-quoted attributes are not affected.
What must an attacker control to exploit this issue?
The attacker must be able to supply a value that the application places in a single-quoted attribute, such as <a href='$value'>. A single quote in that value can terminate the attribute and permit injection of additional attributes, including an event handler.
How can I identify potentially vulnerable code?
Review HTML generated with HTML::Tags or XML::Tags for values inserted into single-quoted attributes, especially values influenced by untrusted input. The affected escaping handles ampersands, double quotes, less-than signs, and greater-than signs, but not single quotes.
What mitigation is available if updating is not immediately possible?
Avoid interpolating untrusted values into single-quoted attributes. Use double-quoted attributes for these values, since the provided information states that double-quoted attributes are not affected.