Web::Simple Vulnerability in Perl Affects Multiple Versions
CVE-2026-114627

Currently unrated

Key Information:

Status
Vendor
CVE Published:
4 November 2026

What is CVE-2026-114627?

Web::Simple versions prior to 0.036 for Perl have a vulnerability that allows for HTML injection through improperly handled interpolations in double-quoted strings. When utilizing HTML::Tags or XML::Tags, risk arises from the handling of string literals. Although direct values like $value are entity-escaped, interpolated string values in the format of "Hello $value" are not sanitized, enabling attackers to inject malicious scripts into web pages by controlling interpolated values.

References

https://github.com/p5sagit/Web-Simple/commit/01e575827fdd...
patch
https://metacpan.org/release/ETHER/Web-Simple-0.036/changes
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.