{"id":"CVE-2026-120644","kind":"vulnerability","aliases":["CVE-2026-120644"],"related":[],"title":"Perl CGI::Cookie: unchecked path, domain and expires values allow cookie attribute injection","description":"CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values.\n\nThe path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters.\n\nAn application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.","summary":"CGI::Cookie before 5.00 writes path, domain and expires values into the Set-Cookie header without rejecting semicolons or control characters. An application that fills these values from request data can be tricked into adding other cookie attributes such as Domain or SameSite.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cgi-cookie","package","perl","web-apps"],"not_affected_if":["hard-coded-cookie-attributes","no-cgi-cookie"],"how_to_check":"- Check the installed CGI::Cookie version with `perl -MCGI::Cookie -e 'print $CGI::Cookie::VERSION'`.\n- Search the codebase for calls that build cookies with `CGI::Cookie->new` where path, domain or expires come from request parameters.","fix":"- CGI::Cookie `5.00` or later, per the linked patch; exact fixed release unknown beyond that.","status":"open","published_at":"2026-11-04T00:17:25+00:00","first_seen_at":"2026-11-04T00:46:17+00:00","triaged_at":"2026-11-04T00:48:10+00:00","updated_at":"2026-11-04T00:48:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T00:48:10Z","model":"claude-haiku-5-5","output":{"fix":"- CGI::Cookie `5.00` or later, per the linked patch; exact fixed release unknown beyond that.","reach":"internet","title":"Perl CGI::Cookie: unchecked path, domain and expires values allow cookie attribute injection","impact":"low","summary":"CGI::Cookie before 5.00 writes path, domain and expires values into the Set-Cookie header without rejecting semicolons or control characters. An application that fills these values from request data can be tricked into adding other cookie attributes such as Domain or SameSite.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","cgi-cookie","web-apps"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker adds cookie attributes like Domain or SameSite","analyst_note":"","how_to_check":"- Check the installed CGI::Cookie version with `perl -MCGI::Cookie -e 'print $CGI::Cookie::VERSION'`.\n- Search the codebase for calls that build cookies with `CGI::Cookie->new` where path, domain or expires come from request parameters.","plain_action":"","needs_analyst":false,"not_affected_if":["hard-coded-cookie-attributes","no-cgi-cookie"],"who_is_affected":"Only applications that use CGI::Cookie and set the path, domain or expires values of a cookie from user-controlled request data are exposed. Apps that hard-code those values, or that do not use CGI::Cookie, can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000698,"input_tokens":4148,"output_tokens":566,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120644':16A,19A '-2026':15A,18A '5.00':31B,76C 'add':63B,123C 'allow':10A,79C 'app':27B 'applic':51B,112C 'attribut':12A,66B,81C,126C 'cgi':2A,21B,28B,72C 'cgi-cooki':20B 'charact':49B,110C 'check':105C 'control':48B,109C 'cooki':3A,11A,22B,29B,42B,65B,73C,80C,102C,125C 'cve':14A,17A 'data':58B,118C 'domain':6A,34B,69B,86C,92C,129C 'expir':8A,36B,88C,94C 'fill':53B 'header':43B,103C 'inject':13A,82C 'made':121C 'packag':23B 'path':5A,33B,85C,91C 'perl':1A,24B,78C 'reject':45B 'request':57B,117C 'samesit':71B,131C 'semicolon':46B,107C 'set':41B,101C,114C 'set-cooki':40B,100C 'trick':61B 'uncheck':4A 'unvalid':84C 'valu':9A,37B,55B,89C,95C 'version':74C 'via':83C 'web':26B 'web-app':25B 'without':44B,104C 'write':32B 'written':97C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use CGI::Cookie and set the path, domain or expires values of a cookie from user-controlled request data are exposed. Apps that hard-code those values, or that do not use CGI::Cookie, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cgicookie","low","package","perl","webapps"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120644","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120644","severity":null,"published_at":"2026-11-04T00:17:25+00:00","modified_at":"2026-11-04T00:17:25+00:00","first_seen_at":"2026-11-04T00:46:17+00:00","fetched_at":"2026-11-04T00:46:17+00:00","note":null}],"documents":[{"id":62124,"url":"https://github.com/leejo/CGI.pm/commit/0b3527faaa9de55f79ca7d59dd3bcfb2c5540e00.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}