---
id: "CVE-2026-114627"
kind: "vulnerability"
aliases: ["CVE-2026-114627"]
title: "Web::Simple for Perl: unescaped values enable script injection in HTML output"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["html-tags", "package", "perl", "web-simple", "xml-tags"]
not_affected_if: ["no-html-tags-or-xml-tags", "values-escaped-manually"]
published_at: "2026-11-04T15:17:35+00:00"
first_seen_at: "2026-11-04T15:27:29+00:00"
updated_at: "2026-11-04T15:28:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114627", "first_seen_at": "2026-11-04T15:27:29+00:00"}]
---

# Web::Simple for Perl: unescaped values enable script injection in HTML output

Web::Simple versions before 0.036 fail to entity-escape values interpolated into double-quoted strings under HTML::Tags or XML::Tags. An attacker who controls such a value can inject script into the generated page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Web::Simple version, for example with `perl -MWeb::Simple -e 'print $Web::Simple::VERSION'`.
- Search application code for `use HTML::Tags` or `use XML::Tags` alongside double-quoted strings that interpolate user-supplied values.

## Fix

- Web::Simple: upgrade to `0.036` or later.

## Timeline

- 2026-11-04T15:27:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114627

## Documents

- [fix] Patch: github.com https://github.com/p5sagit/Web-Simple/commit/01e575827fdd9ba3a08063fd414b1de465380015.patch

## From the sources

Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output.

Under use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step passes such objects through, and stringify joins their interpolated parts as is. A value passed on its own, as in <p>, $value, </p>, is entity-escaped, but the same value in "Hello $value" is not.

An attacker who controls a value that an application interpolates into a double-quoted string can inject script into the generated page.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_