{"id":"CVE-2026-120643","kind":"vulnerability","aliases":["CVE-2026-120643"],"related":[],"title":"Perl CGI: URLs with raw apostrophes enable cross-site scripting","description":"CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url.\n\nBoth pass the URL through URI's canonical method, which leaves an apostrophe in the path raw and decodes the %27 that query parameter escaping produces, so an apostrophe in the request path or a parameter appears raw in the result.\n\nAn application that places the URL in a single-quoted HTML attribute or JavaScript string is open to cross-site scripting.","summary":"The Perl CGI module versions from 4.62 before 5.00 return URLs from its url and self_url methods with apostrophes left raw. An application that places that URL inside a single-quoted HTML attribute or JavaScript string lets an attacker run script in a visitor's browser.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cgi","package","perl","web-apps"],"not_affected_if":["cgi-version-below-4.62","escaped-output","no-url-echoed-in-html"],"how_to_check":"- Check the installed CGI module version with `perl -MCGI -e 'print $CGI::VERSION'`\n- Search the application code for calls to `url` or `self_url` from CGI and look for them placed in single-quoted HTML attributes or JavaScript strings","fix":"- CGI (Perl) versions before `5.00`: move to `5.00` or later","status":"open","published_at":"2026-11-04T00:17:25+00:00","first_seen_at":"2026-11-04T00:46:17+00:00","triaged_at":"2026-11-04T00:48:13+00:00","updated_at":"2026-11-04T00:48:13+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T00:48:13Z","model":"claude-haiku-5-5","output":{"fix":"- CGI (Perl) versions before `5.00`: move to `5.00` or later","reach":"internet","title":"Perl CGI: URLs with raw apostrophes enable cross-site scripting","impact":"medium","summary":"The Perl CGI module versions from 4.62 before 5.00 return URLs from its url and self_url methods with apostrophes left raw. An application that places that URL inside a single-quoted HTML attribute or JavaScript string lets an attacker run script in a visitor's browser.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","cgi","web-apps"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker runs script in visitor's browser via crafted link","analyst_note":"Confirm the exact fixed version and the patch commit from the linked Patch page; sources give no severity score.","how_to_check":"- Check the installed CGI module version with `perl -MCGI -e 'print $CGI::VERSION'`\n- Search the application code for calls to `url` or `self_url` from CGI and look for them placed in single-quoted HTML attributes or JavaScript strings","plain_action":"","needs_analyst":true,"not_affected_if":["cgi-version-below-4.62","no-url-echoed-in-html","escaped-output"],"who_is_affected":"Applications that use the Perl CGI module from 4.62 up to 5.00 and write the URL returned by url or self_url into a single-quoted HTML attribute or JavaScript string are exposed. Applications that do not echo these URLs into such contexts, or that use double-quoted or escaped output, are less exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000724,"input_tokens":4204,"output_tokens":608,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120643':14A,17A '-2026':13A,16A '27':117C '4.62':30B,75C '5.00':32B,77C 'allow':80C 'apostroph':6A,43B,88C,109C,125C 'app':23B 'appear':133C 'applic':47B,139C 'attack':64B 'attribut':58B,150C 'browser':71B 'canon':104C 'cgi':2A,18B,26B,72C 'cross':9A,82C,158C 'cross-sit':8A,81C,157C 'cve':12A,15A 'decod':115C 'enabl':7A 'escap':121C 'html':57B,149C 'insid':52B 'javascript':60B,152C 'leav':107C 'left':44B 'let':62B 'method':41B,105C 'modul':27B 'open':155C 'packag':19B 'paramet':120C,132C 'pass':98C 'path':112C,129C 'perl':1A,20B,25B,79C 'place':49B,141C 'produc':122C 'queri':119C 'quot':56B,148C 'raw':5A,45B,87C,113C,134C 'request':128C 'result':137C 'return':33B,91C 'run':65B 'script':11A,66B,84C,160C 'self':39B,95C 'singl':55B,147C 'single-quot':54B,146C 'site':10A,83C,159C 'string':61B,153C 'uri':102C 'url':3A,34B,37B,40B,51B,90C,93C,96C,100C,143C 'version':28B,73C 'via':85C 'visitor':69B 'web':22B 'web-app':21B","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Perl CGI module from 4.62 up to 5.00 and write the URL returned by url or self_url into a single-quoted HTML attribute or JavaScript string are exposed. Applications that do not echo these URLs into such contexts, or that use double-quoted or escaped output, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cgi","medium","package","perl","webapps"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120643","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120643","severity":null,"published_at":"2026-11-04T00:17:25+00:00","modified_at":"2026-11-04T00:17:25+00:00","first_seen_at":"2026-11-04T00:46:17+00:00","fetched_at":"2026-11-04T00:46:17+00:00","note":null}],"documents":[{"id":62123,"url":"https://github.com/leejo/CGI.pm/commit/851430be84c4d0f350681814e1d7718b9959f2c2.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}