HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected.
An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to Web-Simple 0.037 or later.
Vendor Workaround
Use double-quoted attributes for values that may contain untrusted data.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 10 Nov 2026 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output. HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected. An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page. | |
| Title | Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output | |
| Weaknesses | CWE-79 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-11-10T17:42:05.207Z
Reserved: 2026-10-31T13:26:38.835Z
Link: CVE-2026-120212
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-10T18:17:19.447
Modified: 2026-11-10T18:17:19.447
Link: CVE-2026-120212
Redhat
No data.
OpenCVE Enrichment
No data.