Live › vulnerability › CVE-2026-120638
The Perl CGI module, before version 5.00, decodes HTML entities in a redirect URL after the application has validated it. An attacker can craft a link that passes the check but sends the user to a different external site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Applications that use the Perl CGI module's redirect function with URLs that include user input after validation. Scripts that never redirect to user-supplied URLs, or that use a newer version, are not exposed.
No product ranges from the sources yet.
CGI in Perl dependencies, for example with perl -MCGI -e 'print $CGI::VERSION'redirect from the CGI module with user-supplied URLs5.00 or later (per the sources; confirm against the release)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.
redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.
This page as .md · .json · in your agent: get_signal("CVE-2026-120638")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.