Live › vulnerability › CVE-2026-120636
The Perl CGI module builds URLs for links and forms from the client-supplied REQUEST_URI without validation. An attacker can make those links and form posts point to another host, or inject a javascript: URL.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Web applications that use the Perl CGI module and build links or forms with url(-absolute=>1), url(-relative=>1) or the default start_form action are exposed. Applications that do not use CGI.pm, or that use it without these URL helpers, are less exposed; the sources do not say how the flaw is triggered beyond these calls.
No product ranges from the sources yet.
perl -MCGI -e 'print $CGI::VERSION'.url(-absolute=>1), url(-relative=>1) and start_form calls.5.00 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form.
url(-absolute=>1), url(-relative=>1) and the default start_form action are built from the client-supplied REQUEST_URI without validation. The result can be protocol-relative (//evil.example), absolute-form (http://evil.example/) or contain backslashes, and url(-relative=>1) can return a javascript: URL. Links and form posts built from these URLs can go to another host.
This page as .md · .json · in your agent: get_signal("CVE-2026-120636")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.