Cross-Site Scripting Vulnerability in CGI for Perl by Leejo
CVE-2026-120643

Currently unrated

Key Information:

Status
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120643?

The affected CGI versions for Perl allow attackers to exploit cross-site scripting vulnerabilities via improperly handled URL encoding. When raw apostrophes are included in URLs, they can be reflected in the output without proper sanitization, potentially exposing applications to XSS attacks. This occurs because the URL is processed through URI's canonical method that fails to adequately escape single quotes, which compromises the security of any application that includes user-supplied URLs in HTML attributes or JavaScript. Developers should upgrade to CGI version 5.00 or later to mitigate this risk.

References

https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CG...
technical-description
https://metacpan.org/release/LEEJO/CGI-5.00/changes
release-notes
https://github.com/leejo/CGI.pm/commit/851430be84c4d0f350...
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.