CVE-2026-120212
Received Received - Intake

XSS via Single-Quoted Attribute in Web::Simple for Perl

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: CPANSec

Description
Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output. HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected. An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-11
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-120212
EUVD
EUVD-2026-121639

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
p5sagit web_simple to 0.037 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Web::Simple versions before 0.037 for Perl. It fails to escape single quotes in HTML::Tags output. HTML::Tags and XML::Tags only escape &, ", <, and > characters. When a value is inserted into a single-quoted HTML attribute like href='$value', an attacker controlling that value can inject malicious script by closing the attribute and adding new ones such as event handlers.

Impact Analysis

If you use a vulnerable version of Web::Simple, an attacker could inject malicious scripts into web pages generated by your application. This could lead to cross-site scripting (XSS) attacks, allowing theft of user sessions, defacement of pages, or delivery of malware to users.

Compliance Impact

This vulnerability could lead to unauthorized script execution, potentially enabling data breaches or unauthorized access to user data. This may violate GDPR's requirement for protecting personal data and HIPAA's safeguards for protected health information, risking non-compliance and legal penalties.

Mitigation Strategies

Update Web::Simple to version 0.037 or later to ensure proper escaping of single quotes in HTML::Tags output. Avoid using single-quoted attributes in HTML generation when interpolating user-controlled values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120212. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...