Live › vulnerability › CVE-2026-120643
The Perl CGI module versions from 4.62 before 5.00 return URLs from its url and self_url methods with apostrophes left raw. An application that places that URL inside a single-quoted HTML attribute or JavaScript string lets an attacker run script in a visitor's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Applications that use the Perl CGI module from 4.62 up to 5.00 and write the URL returned by url or self_url into a single-quoted HTML attribute or JavaScript string are exposed. Applications that do not echo these URLs into such contexts, or that use double-quoted or escaped output, are less exposed.
No product ranges from the sources yet.
perl -MCGI -e 'print $CGI::VERSION'url or self_url from CGI and look for them placed in single-quoted HTML attributes or JavaScript strings5.00: move to 5.00 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url.
Both pass the URL through URI's canonical method, which leaves an apostrophe in the path raw and decodes the %27 that query parameter escaping produces, so an apostrophe in the request path or a parameter appears raw in the result.
An application that places the URL in a single-quoted HTML attribute or JavaScript string is open to cross-site scripting.
This page as .md · .json · in your agent: get_signal("CVE-2026-120643")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.