CVE-2026-120212
- Source
- https://cve.org/CVERecord?id=CVE-2026-120212
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-120212.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-120212
- Downstream
- Published
- 2026-11-10T17:42:05Z
- Modified
- 2026-11-12T02:48:03Z
- Summary
- Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output
- Details
-
Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output.
HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", < and > with entities. A value interpolated into a single-quoted attribute, as in , can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected.
An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.
- Database specific
{ "cna_assigner": "CPANSec", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120212.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "fixed": "0.037" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] }, { "extracted_events": [ { "range": [ { "fixed": "0.037" } ], "source": "DESCRIPTION" } ] } ] }- References
-
- https://cpan.org/modules
- https://www.cve.org/CVERecord?id=CVE-2026-5090
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120212.json
- https://metacpan.org/release/ETHER/Web-Simple-0.037/changes
- https://nvd.nist.gov/vuln/detail/CVE-2026-120212
- https://github.com/p5sagit/Web-Simple/commit/de0b7743f7015ec2c1c678dfdaa4bc6f5ccfb640.patch
- https://github.com/p5sagit/Web-Simple
Affected packages
Git / github.com/p5sagit/web-simple
Affected ranges
- Type
- GIT
- Repo
- https://github.com/p5sagit/web-simple
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "fixed": "de0b7743f7015ec2c1c678dfdaa4bc6f5ccfb640" } ], "source": "REFERENCES_COMMIT" } ] }