CVE-2026-114627 · Package
NO FIX YET · SEE WHAT TO DO
Web::Simple versions before 0.036 fail to entity-escape values interpolated into double-quoted strings under HTML::Tags or XML::Tags. An attacker who controls such a value can inject script into the generated page.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Applications that use Web::Simple together with HTML::Tags or XML::Tags and interpolate attacker-controllable values into double-quoted strings in rendered output. Values passed on their own as separate arguments are escaped and not affected. Applications that do not use these modules, or that do not render untrusted values this way, can skip it.
Not affected if no-html-tags-or-xml-tags, values-escaped-manually
Who cares html-tags, perl, web-simple, xml-tags
perl -MWeb::Simple -e 'print $Web::Simple::VERSION'.use HTML::Tags or use XML::Tags alongside double-quoted strings that interpolate user-supplied values.0.036 or later.Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output.
Under use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step passes such objects through, and stringify joins their interpolated parts as is. A value passed on its own, as in <p>, $value, </p>, is entity-escaped, but the same value in "Hello $value" is not.
An attacker who controls a value that an application interpolates into a double-quoted string can inject script into the generated page.
This page as .md · .json · in your agent: get_signal("CVE-2026-114627")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.