{"id":"CVE-2026-114627","kind":"vulnerability","aliases":["CVE-2026-114627"],"related":[],"title":"Web::Simple for Perl: unescaped values enable script injection in HTML output","description":"Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output.\n\nUnder use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step passes such objects through, and stringify joins their interpolated parts as is. A value passed on its own, as in <p>, $value, </p>, is entity-escaped, but the same value in \"Hello $value\" is not.\n\nAn attacker who controls a value that an application interpolates into a double-quoted string can inject script into the generated page.","summary":"Web::Simple versions before 0.036 fail to entity-escape values interpolated into double-quoted strings under HTML::Tags or XML::Tags. An attacker who controls such a value can inject script into the generated page.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["html-tags","package","perl","web-simple","xml-tags"],"not_affected_if":["no-html-tags-or-xml-tags","values-escaped-manually"],"how_to_check":"- Check the installed Web::Simple version, for example with `perl -MWeb::Simple -e 'print $Web::Simple::VERSION'`.\n- Search application code for `use HTML::Tags` or `use XML::Tags` alongside double-quoted strings that interpolate user-supplied values.","fix":"- Web::Simple: upgrade to `0.036` or later.","status":"open","published_at":"2026-11-04T15:17:35+00:00","first_seen_at":"2026-11-04T15:27:29+00:00","triaged_at":"2026-11-04T15:28:40+00:00","updated_at":"2026-11-04T15:28:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T15:28:40Z","model":"claude-haiku-5-5","output":{"fix":"- Web::Simple: upgrade to `0.036` or later.","reach":"internet","title":"Web::Simple for Perl: unescaped values enable script injection in HTML output","impact":"medium","summary":"Web::Simple versions before 0.036 fail to entity-escape values interpolated into double-quoted strings under HTML::Tags or XML::Tags. An attacker who controls such a value can inject script into the generated page.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","web-simple","html-tags","xml-tags"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker injects script into pages served to other users","analyst_note":"","how_to_check":"- Check the installed Web::Simple version, for example with `perl -MWeb::Simple -e 'print $Web::Simple::VERSION'`.\n- Search application code for `use HTML::Tags` or `use XML::Tags` alongside double-quoted strings that interpolate user-supplied values.","plain_action":"","needs_analyst":false,"not_affected_if":["no-html-tags-or-xml-tags","values-escaped-manually"],"who_is_affected":"Applications that use Web::Simple together with HTML::Tags or XML::Tags and interpolate attacker-controllable values into double-quoted strings in rendered output. Values passed on their own as separate arguments are escaped and not affected. Applications that do not use these modules, or that do not render untrusted values this way, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000704,"input_tokens":4232,"output_tokens":561,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114627':15A,18A '-2026':14A,17A '0.036':34B,71C 'applic':160C 'attack':54B,153C 'becom':102C 'control':56B,155C 'cve':13A,16A 'doubl':44B,81C,98C,165C 'double-quot':43B,80C,97C,164C 'enabl':7A 'entiti':38B,141C 'entity-escap':37B,140C 'escap':39B,76C,116C,142C 'fail':35B 'generat':65B,173C 'hello':148C 'hold':107C 'html':11A,20B,48B,85C,90C 'html-tag':19B 'inject':9A,61B,169C 'interpol':41B,78C,109C,126C,161C 'join':124C 'liter':101C 'object':105C,120C 'output':12A,87C 'packag':22B 'page':66B,174C 'part':114C,127C 'pass':118C,132C 'perl':4A,23B,73C 'quot':45B,82C,99C,166C 'script':8A,62B,170C 'separ':113C 'simpl':2A,26B,31B,68C 'step':117C 'string':46B,83C,100C,167C 'stringifi':123C 'stringth':104C 'tag':21B,29B,49B,52B,86C,91C,95C 'unescap':5A 'use':89C,93C 'valu':6A,40B,59B,77C,110C,131C,138C,146C,149C,157C 'version':32B,69C 'web':1A,25B,30B,67C 'web-simpl':24B 'xml':28B,51B,94C 'xml-tag':27B","nicknames":[],"mitigations":[],"who_affected":"Applications that use Web::Simple together with HTML::Tags or XML::Tags and interpolate attacker-controllable values into double-quoted strings in rendered output. Values passed on their own as separate arguments are escaped and not affected. Applications that do not use these modules, or that do not render untrusted values this way, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["htmltags","package","perl","unknown","websimple","xmltags"],"campaign_type":null,"first_public_at":"2026-11-04T15:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114627","severity":null,"published_at":"2026-11-04T15:17:35+00:00","modified_at":"2026-11-04T15:17:35+00:00","first_seen_at":"2026-11-04T15:27:29+00:00","fetched_at":"2026-11-04T15:27:29+00:00","note":null}],"documents":[{"id":67827,"url":"https://github.com/p5sagit/Web-Simple/commit/01e575827fdd9ba3a08063fd414b1de465380015.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}