{"id":"CVE-2026-120642","kind":"vulnerability","aliases":["CVE-2026-120642"],"related":[],"title":"Perl CGI module returns request values untainted, bypassing taint checks","description":"CGI versions before 5.00 for Perl return request-derived values untainted under taint mode.\n\nThe upload filename, uploadInfo values, some path_info and script_name values, Accept results, and the name lists from url_param and cookie are returned without the taint flag, as is a cookie named expires from 4.67 on.\n\nThese values come from regex captures or hash keys, which Perl does not taint, so they pass -T checks unvalidated.","summary":"Versions of the Perl CGI module before 5.00 return some request-derived values, such as upload filenames, cookie names and path info, without the taint flag under Perl's taint mode. Code that relies on taint mode to catch unvalidated input can therefore treat attacker-supplied data as safe.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cgi","package","perl","web-apps"],"not_affected_if":["no-taint-mode","not-using-cgi-module"],"how_to_check":"- Check the installed CGI version with `perl -MCGI -e 'print $CGI::VERSION'`\n- Look for scripts run with `-T` (taint mode) that use CGI.pm for uploads, cookies or path info","fix":"- Upgrade CGI to `5.00` or later","status":"open","published_at":"2026-11-04T00:17:25+00:00","first_seen_at":"2026-11-04T00:46:17+00:00","triaged_at":"2026-11-04T00:48:15+00:00","updated_at":"2026-11-04T00:48:15+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T00:48:15Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade CGI to `5.00` or later","reach":"network","title":"Perl CGI module returns request values untainted, bypassing taint checks","impact":"medium","summary":"Versions of the Perl CGI module before 5.00 return some request-derived values, such as upload filenames, cookie names and path info, without the taint flag under Perl's taint mode. Code that relies on taint mode to catch unvalidated input can therefore treat attacker-supplied data as safe.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","cgi","web-apps"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"unvalidated request input reaches code that expects tainted data checks","analyst_note":"Confirm the exact CVSS and whether any exploit path beyond bypassing taint checks is shown; check the linked patch on github.com.","how_to_check":"- Check the installed CGI version with `perl -MCGI -e 'print $CGI::VERSION'`\n- Look for scripts run with `-T` (taint mode) that use CGI.pm for uploads, cookies or path info","plain_action":"","needs_analyst":true,"not_affected_if":["not-using-cgi-module","no-taint-mode"],"who_is_affected":"Applications that run Perl CGI scripts under taint mode and depend on it to validate request data. Systems that do not use the CGI module, or that do not run under taint mode, are less exposed; the sources do not say how far the exposure reaches.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000698,"input_tokens":4157,"output_tokens":564,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120642':13A,16A '-2026':12A,15A '4.67':125C '5.00':30B,77C 'accept':101C 'app':22B 'attack':69B 'attacker-suppli':68B 'bypass':8A 'captur':132C 'catch':62B 'cgi':2A,17B,27B,74C 'check':10A,145C 'code':55B 'come':129C 'cooki':41B,111C,121C 'cve':11A,14A 'data':71B 'deriv':35B,83C 'expir':123C 'filenam':40B,91C 'flag':49B,117C 'hash':134C 'info':45B,96C 'input':64B 'key':135C 'list':106C 'mode':54B,60B,88C 'modul':3A,28B 'name':42B,99C,105C,122C 'packag':18B 'param':109C 'pass':143C 'path':44B,95C 'perl':1A,19B,26B,51B,79C,137C 'regex':131C 'reli':57B 'request':5A,34B,82C 'request-deriv':33B,81C 'result':102C 'return':4A,31B,80C,113C 'safe':73B 'script':98C 'suppli':70B 'taint':9A,48B,53B,59B,87C,116C,140C 'therefor':66B 'treat':67B 'untaint':7A,85C 'unvalid':63B,146C 'upload':39B,90C 'uploadinfo':92C 'url':108C 'valu':6A,36B,84C,93C,100C,128C 'version':23B,75C 'web':21B 'web-app':20B 'without':46B,114C","nicknames":[],"mitigations":[],"who_affected":"Applications that run Perl CGI scripts under taint mode and depend on it to validate request data. Systems that do not use the CGI module, or that do not run under taint mode, are less exposed; the sources do not say how far the exposure reaches.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cgi","package","perl","unknown","webapps"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120642","severity":null,"published_at":"2026-11-04T00:17:25+00:00","modified_at":"2026-11-04T00:17:25+00:00","first_seen_at":"2026-11-04T00:46:17+00:00","fetched_at":"2026-11-04T00:46:17+00:00","note":null}],"documents":[{"id":62122,"url":"https://github.com/leejo/CGI.pm/commit/6ae50ce84073b8f68a6e3750479de70d5b8f2dcf.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}