CVE-2026-120212
Publication date 12 November 2026
Last updated 12 November 2026
Ubuntu priority
Description
Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output. HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected. An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| libweb-simple-perl | 26.10 stonking |
Needs evaluation
|
| 26.04 LTS resolute |
Needs evaluation
|
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2026-120212
- https://lists.security.metacpan.org/cve-announce/msg/45042131/
- https://github.com/p5sagit/Web-Simple/commit/de0b7743f7015ec2c1c678dfdaa4bc6f5ccfb640.patch
- https://metacpan.org/release/ETHER/Web-Simple-0.037/changes
- https://www.cve.org/CVERecord?id=CVE-2026-5090