{"id":"CVE-2026-120212","kind":"vulnerability","aliases":["CVE-2026-120212"],"related":[],"title":"Web::Simple: single quotes unescaped in HTML::Tags output enables script injection","description":"Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output.\n\nHTML::Tags and XML::Tags escape a plain string value by replacing only &, \", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected.\n\nAn attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.","summary":"Web::Simple versions before 0.037 for Perl do not escape single quotes when HTML::Tags builds HTML. A value placed inside a single-quoted attribute can close the attribute and add an event handler, so an attacker can run script in the victim's browser.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["html-tags","package","perl","web-simple"],"not_affected_if":["double-quoted-attributes","no-user-controlled-values"],"how_to_check":"- Check the installed Web::Simple version with `perl -MWeb::Simple -e 'print $Web::Simple::VERSION'`\n- Search application code for HTML::Tags or XML::Tags output that interpolates user values into single-quoted attributes, such as `href='$value'`","fix":"- Web::Simple: move to `0.037` or later","status":"open","published_at":"2026-11-10T18:17:19+00:00","first_seen_at":"2026-11-10T18:22:55+00:00","triaged_at":"2026-11-10T18:26:49+00:00","updated_at":"2026-11-10T18:26:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T18:26:49Z","model":"claude-haiku-5-5","output":{"fix":"- Web::Simple: move to `0.037` or later","reach":"internet","title":"Web::Simple: single quotes unescaped in HTML::Tags output enables script injection","impact":"medium","summary":"Web::Simple versions before 0.037 for Perl do not escape single quotes when HTML::Tags builds HTML. A value placed inside a single-quoted attribute can close the attribute and add an event handler, so an attacker can run script in the victim's browser.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","web-simple","html-tags"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Script runs in victim browsers on the affected application's pages.","analyst_note":"","how_to_check":"- Check the installed Web::Simple version with `perl -MWeb::Simple -e 'print $Web::Simple::VERSION'`\n- Search application code for HTML::Tags or XML::Tags output that interpolates user values into single-quoted attributes, such as `href='$value'`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["double-quoted-attributes","no-user-controlled-values"],"who_is_affected":"Applications built on Web::Simple that use HTML::Tags to render user-controlled values inside single-quoted HTML attributes. Double-quoted attributes are not affected, and applications that do not pass attacker-controlled values into HTML::Tags output can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000735,"input_tokens":4628,"output_tokens":544,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120212':15A,18A '-2026':14A,17A '0.037':31B,77C 'add':58B,122C 'affect':136C 'applic':145C 'attack':64B,138C 'attribut':52B,56B,113C,120C,133C,152C 'browser':72B 'build':42B 'close':54B,118C 'control':140C 'cve':13A,16A 'doubl':131C 'double-quot':130C 'enabl':10A 'entiti':104C 'escap':36B,82C,94C 'event':60B,128C 'generat':158C 'handler':61B,129C 'html':7A,20B,40B,43B,86C,89C 'html-tag':19B 'inject':12A,154C 'insid':47B 'interpol':107C,146C 'new':123C 'one':124C 'output':9A,88C 'packag':22B 'page':159C 'perl':23B,33B,79C 'place':46B 'plain':96C 'quot':4A,38B,51B,84C,112C,132C,151C 'replac':100C 'run':66B 'script':11A,67B,155C 'simpl':2A,26B,28B,74C 'singl':3A,37B,50B,83C,111C,150C 'single-quot':49B,110C,149C 'string':97C 'tag':8A,21B,41B,87C,90C,93C 'therefor':117C 'unescap':5A 'valu':45B,98C,106C,142C 'version':29B,75C 'victim':70B 'web':1A,25B,27B,73C 'web-simpl':24B 'xml':92C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Web::Simple that use HTML::Tags to render user-controlled values inside single-quoted HTML attributes. Double-quoted attributes are not affected, and applications that do not pass attacker-controlled values into HTML::Tags output can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["htmltags","medium","package","perl","websimple"],"campaign_type":null,"search_a":"'-120212':15A,18A '-2026':14A,17A 'cve':13A,16A 'enabl':10A 'html':7A 'inject':12A 'output':9A 'quot':4A 'script':11A 'simpl':2A 'singl':3A 'tag':8A 'unescap':5A 'web':1A","search_b":"'0.037':31B 'add':58B 'attack':64B 'attribut':52B,56B 'browser':72B 'build':42B 'close':54B 'escap':36B 'event':60B 'handler':61B 'html':20B,40B,43B 'html-tag':19B 'insid':47B 'packag':22B 'perl':23B,33B 'place':46B 'quot':38B,51B 'run':66B 'script':67B 'simpl':26B,28B 'singl':37B,50B 'single-quot':49B 'tag':21B,41B 'valu':45B 'version':29B 'victim':70B 'web':25B,27B 'web-simpl':24B","search_c":"'0.037':77C 'add':122C 'affect':136C 'applic':145C 'attack':138C 'attribut':113C,120C,133C,152C 'close':118C 'control':140C 'doubl':131C 'double-quot':130C 'entiti':104C 'escap':82C,94C 'event':128C 'generat':158C 'handler':129C 'html':86C,89C 'inject':154C 'interpol':107C,146C 'new':123C 'one':124C 'output':88C 'page':159C 'perl':79C 'plain':96C 'quot':84C,112C,132C,151C 'replac':100C 'script':155C 'simpl':74C 'singl':83C,111C,150C 'single-quot':110C,149C 'string':97C 'tag':87C,90C,93C 'therefor':117C 'valu':98C,106C,142C 'version':75C 'web':73C 'xml':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120212","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120212","severity":null,"published_at":"2026-11-10T18:17:19+00:00","modified_at":"2026-11-10T18:17:19+00:00","first_seen_at":"2026-11-10T18:22:55+00:00","fetched_at":"2026-11-10T18:22:55+00:00","note":null}],"documents":[{"id":116894,"url":"https://github.com/p5sagit/Web-Simple/commit/de0b7743f7015ec2c1c678dfdaa4bc6f5ccfb640.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}