HTML Injection Vulnerability in CGI for Perl by Leejo
CVE-2026-120648

Currently unrated

Key Information:

Status
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120648?

The CGI module for Perl versions prior to 5.00 is susceptible to HTML injection due to inadequate escaping of user inputs within comments. Specifically, inputs containing the sequence '-->' can prematurely terminate comments, enabling the injection of arbitrary HTML into webpages. This poses a significant risk for web applications that utilize this module for handling comment data, allowing attackers to manipulate the page content and potentially execute harmful scripts.

References

https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CG...
technical-description
https://metacpan.org/release/LEEJO/CGI-5.00/changes
release-notes
https://github.com/leejo/CGI.pm/commit/6a17eb84703d84bca8...
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.