{"id":"CVE-2026-125729","kind":"vulnerability","aliases":["CVE-2026-125729"],"related":[],"title":"Plack CSP middleware sends wrong header, so browsers skip policy","description":"Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it.\n\nThe call method sets the policy in a response header named \"content-security-protocol\" instead of \"Content-Security-Policy\". Browsers ignore that header.\n\nAny cross-site scripting flaw in the wrapped application can run scripts the policy was meant to block.","summary":"Plack::Middleware::CSP before 0.03 for Perl writes the Content Security Policy into a header named content-security-protocol instead of Content-Security-Policy. Browsers ignore that header, so any cross-site scripting flaw in the wrapped application can run scripts the policy was meant to block.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Plack::Middleware::CSP","fixed":[],"affected":"","ecosystem":"cargo"}],"ecosystems":["cargo"],"tags":["package","perl","plack","web-apps"],"not_affected_if":["not-using-plack-csp","version-0.03-or-later"],"how_to_check":"- Check the installed version of Plack::Middleware::CSP with `perl -MPlack::Middleware::CSP -e 'print $Plack::Middleware::CSP::VERSION'`\n- Look for Plack::Middleware::CSP in the cpanfile, cpanfile.snapshot or Makefile.PL of the application\n- Inspect a response's headers and confirm whether a Content-Security-Policy header is present","fix":"- Plack::Middleware::CSP: move to version `0.03` or later (per the advisory, versions before 0.03 are affected)","status":"open","published_at":"2026-11-10T18:17:35+00:00","first_seen_at":"2026-11-10T18:22:56+00:00","triaged_at":"2026-11-10T18:26:35+00:00","updated_at":"2026-11-10T18:26:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T18:26:35Z","model":"claude-haiku-5-5","output":{"fix":"- Plack::Middleware::CSP: move to version `0.03` or later (per the advisory, versions before 0.03 are affected)","reach":"internet","title":"Plack CSP middleware sends wrong header, so browsers skip policy","impact":"medium","summary":"Plack::Middleware::CSP before 0.03 for Perl writes the Content Security Policy into a header named content-security-protocol instead of Content-Security-Policy. Browsers ignore that header, so any cross-site scripting flaw in the wrapped application can run scripts the policy was meant to block.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","plack","web-apps"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Cross-site scripting in the app runs unblocked by policy","analyst_note":"","how_to_check":"- Check the installed version of Plack::Middleware::CSP with `perl -MPlack::Middleware::CSP -e 'print $Plack::Middleware::CSP::VERSION'`\n- Look for Plack::Middleware::CSP in the cpanfile, cpanfile.snapshot or Makefile.PL of the application\n- Inspect a response's headers and confirm whether a Content-Security-Policy header is present","plain_action":"","product_name":"Plack::Middleware::CSP","needs_analyst":false,"not_affected_if":["not-using-plack-csp","version-0.03-or-later"],"who_is_affected":"Applications written in Perl that use Plack::Middleware::CSP to set a Content Security Policy. The policy is silently not sent, so the application has no CSP protection against cross-site scripting even though the configuration appears to be in place. Applications that do not use this middleware are not affected.","user_interaction":"unknown","product_ecosystem":"cargo","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000789,"input_tokens":4582,"output_tokens":661,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-125729':13A,16A '-2026':12A,15A '0.03':30B,81C 'app':25B 'applic':66B,133C 'block':75B,142C 'browser':8A,52B,95C,120C 'call':100C 'content':35B,43B,49B,86C,111C,117C 'content-security-polici':48B,116C 'content-security-protocol':42B,110C 'cross':59B,126C 'cross-sit':58B,125C 'csp':2A,19A,28B,78C 'cve':11A,14A 'enforc':97C 'flaw':62B,129C 'header':6A,40B,55B,92C,108C,123C 'ignor':53B,121C 'instead':46B,114C 'meant':73B,140C 'method':101C 'middlewar':3A,27B,77C 'middleware':18A 'name':41B,93C,109C 'never':96C 'packag':20B 'perl':21B,32B,83C 'plack':1A,17A,22B,26B,76C 'polici':10A,37B,51B,71B,88C,104C,119C,138C 'protocol':45B,113C 'respons':107C 'run':68B,135C 'script':61B,69B,128C,136C 'secur':36B,44B,50B,87C,112C,118C 'send':4A,84C 'set':102C 'site':60B,127C 'skip':9A 'version':79C 'web':24B 'web-app':23B 'wrap':65B,132C 'write':33B 'wrong':5A,91C","nicknames":[],"mitigations":[],"who_affected":"Applications written in Perl that use Plack::Middleware::CSP to set a Content Security Policy. The policy is silently not sent, so the application has no CSP protection against cross-site scripting even though the configuration appears to be in place. Applications that do not use this middleware are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["plackmiddlewarecsp"],"ptokens":["csp","middleware","plack"],"labels":["cargo","low","package","perl","plack","webapps"],"campaign_type":null,"search_a":"'-125729':13A,16A '-2026':12A,15A 'browser':8A 'csp':2A,19A 'cve':11A,14A 'header':6A 'middlewar':3A 'middleware':18A 'plack':1A,17A 'polici':10A 'send':4A 'skip':9A 'wrong':5A","search_b":"'0.03':30B 'app':25B 'applic':66B 'block':75B 'browser':52B 'content':35B,43B,49B 'content-security-polici':48B 'content-security-protocol':42B 'cross':59B 'cross-sit':58B 'csp':28B 'flaw':62B 'header':40B,55B 'ignor':53B 'instead':46B 'meant':73B 'middlewar':27B 'name':41B 'packag':20B 'perl':21B,32B 'plack':22B,26B 'polici':37B,51B,71B 'protocol':45B 'run':68B 'script':61B,69B 'secur':36B,44B,50B 'site':60B 'web':24B 'web-app':23B 'wrap':65B 'write':33B","search_c":"'0.03':81C 'applic':133C 'block':142C 'browser':95C,120C 'call':100C 'content':86C,111C,117C 'content-security-polici':116C 'content-security-protocol':110C 'cross':126C 'cross-sit':125C 'csp':78C 'enforc':97C 'flaw':129C 'header':92C,108C,123C 'ignor':121C 'instead':114C 'meant':140C 'method':101C 'middlewar':77C 'name':93C,109C 'never':96C 'perl':83C 'plack':76C 'polici':88C,104C,119C,138C 'protocol':113C 'respons':107C 'run':135C 'script':128C,136C 'secur':87C,112C,118C 'send':84C 'set':102C 'site':127C 'version':79C 'wrap':132C 'wrong':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125729","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125729","severity":null,"published_at":"2026-11-10T18:17:35+00:00","modified_at":"2026-11-10T18:17:35+00:00","first_seen_at":"2026-11-10T18:22:56+00:00","fetched_at":"2026-11-10T18:22:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}