---
id: "CVE-2026-120642"
kind: "vulnerability"
aliases: ["CVE-2026-120642"]
title: "Perl CGI module returns request values untainted, bypassing taint checks"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cgi", "package", "perl", "web-apps"]
not_affected_if: ["no-taint-mode", "not-using-cgi-module"]
published_at: "2026-11-04T00:17:25+00:00"
first_seen_at: "2026-11-04T00:46:17+00:00"
updated_at: "2026-11-04T00:48:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120642", "first_seen_at": "2026-11-04T00:46:17+00:00"}]
---

# Perl CGI module returns request values untainted, bypassing taint checks

Versions of the Perl CGI module before 5.00 return some request-derived values, such as upload filenames, cookie names and path info, without the taint flag under Perl's taint mode. Code that relies on taint mode to catch unvalidated input can therefore treat attacker-supplied data as safe.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed CGI version with `perl -MCGI -e 'print $CGI::VERSION'`
- Look for scripts run with `-T` (taint mode) that use CGI.pm for uploads, cookies or path info

## Fix

- Upgrade CGI to `5.00` or later

## Timeline

- 2026-11-04T00:46:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120642

## Documents

- [fix] Patch: github.com https://github.com/leejo/CGI.pm/commit/6ae50ce84073b8f68a6e3750479de70d5b8f2dcf.patch

## From the sources

CGI versions before 5.00 for Perl return request-derived values untainted under taint mode.

The upload filename, uploadInfo values, some path_info and script_name values, Accept results, and the name lists from url_param and cookie are returned without the taint flag, as is a cookie named expires from 4.67 on.

These values come from regex captures or hash keys, which Perl does not taint, so they pass -T checks unvalidated.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_