---
id: "CVE-2026-120643"
kind: "vulnerability"
aliases: ["CVE-2026-120643"]
title: "Perl CGI: URLs with raw apostrophes enable cross-site scripting"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cgi", "package", "perl", "web-apps"]
not_affected_if: ["cgi-version-below-4.62", "escaped-output", "no-url-echoed-in-html"]
published_at: "2026-11-04T00:17:25+00:00"
first_seen_at: "2026-11-04T00:46:17+00:00"
updated_at: "2026-11-04T00:48:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120643", "first_seen_at": "2026-11-04T00:46:17+00:00"}]
---

# Perl CGI: URLs with raw apostrophes enable cross-site scripting

The Perl CGI module versions from 4.62 before 5.00 return URLs from its url and self_url methods with apostrophes left raw. An application that places that URL inside a single-quoted HTML attribute or JavaScript string lets an attacker run script in a visitor's browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed CGI module version with `perl -MCGI -e 'print $CGI::VERSION'`
- Search the application code for calls to `url` or `self_url` from CGI and look for them placed in single-quoted HTML attributes or JavaScript strings

## Fix

- CGI (Perl) versions before `5.00`: move to `5.00` or later

## Timeline

- 2026-11-04T00:46:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120643

## Documents

- [fix] Patch: github.com https://github.com/leejo/CGI.pm/commit/851430be84c4d0f350681814e1d7718b9959f2c2.patch

## From the sources

CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url.

Both pass the URL through URI's canonical method, which leaves an apostrophe in the path raw and decodes the %27 that query parameter escaping produces, so an apostrophe in the request path or a parameter appears raw in the result.

An application that places the URL in a single-quoted HTML attribute or JavaScript string is open to cross-site scripting.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_