Live › vulnerability › CVE-2026-120648
CGI.pm versions before 5.00 for Perl place arguments inside HTML comments without escaping, so text containing --> closes the comment early. An application that passes request data into the comment helper can have HTML injected into its pages.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Applications that use the Perl CGI module and pass user-supplied request data into its comment output are exposed. Sites that do not pass request data to the comment helper, or that run a newer CGI release, can skip it.
No product ranges from the sources yet.
perl -MCGI -e 'print $CGI::VERSION'5.00 or later (per the NVD description; confirm against the patch link)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment.
Arguments are placed between <!-- and --> without escaping, so text containing --> closes the comment early.
An application that passes request data to comment can be made to inject HTML into the page.
This page as .md · .json · in your agent: get_signal("CVE-2026-120648")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.