{"id":"CVE-2026-120212","summary":"Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output","details":"Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output.\n\nHTML::Tags and XML::Tags escape a plain string value by replacing only &, \", \u003c and \u003e with entities. A value interpolated into a single-quoted attribute, as in \u003ca href='$value'\u003e, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected.\n\nAn attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.","modified":"2026-11-12T02:48:03.316128131Z","published":"2026-11-10T17:42:05.207Z","database_specific":{"cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120212.json","unresolved_ranges":[{"extracted_events":[{"strategy":"StandardRange","range":[{"fixed":"0.037"}],"source":"AFFECTED_FIELD"}]},{"extracted_events":[{"range":[{"fixed":"0.037"}],"source":"DESCRIPTION"}]}],"cna_assigner":"CPANSec"},"references":[{"type":"WEB","url":"https://cpan.org/modules"},{"type":"WEB","url":"https://www.cve.org/CVERecord?id=CVE-2026-5090"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120212.json"},{"type":"ADVISORY","url":"https://metacpan.org/release/ETHER/Web-Simple-0.037/changes"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120212"},{"type":"FIX","url":"https://github.com/p5sagit/Web-Simple/commit/de0b7743f7015ec2c1c678dfdaa4bc6f5ccfb640.patch"},{"type":"PACKAGE","url":"https://github.com/p5sagit/Web-Simple"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/p5sagit/web-simple","events":[{"introduced":"0"},{"fixed":"de0b7743f7015ec2c1c678dfdaa4bc6f5ccfb640"}],"database_specific":{"extracted_events":[{"source":"REFERENCES_COMMIT","range":[{"fixed":"de0b7743f7015ec2c1c678dfdaa4bc6f5ccfb640"}]}]}}],"versions":["v0.036","v0.035","v0.034","v0.033","v0.032","v0.031","v0.030","v0.029","v0.028","v0.027","v0.026_001","v0.026","v0.025","v0.024","v0.023","v0.022","v0.021","v0.020","v0.019","v0.018","v0.016","v0.015","v0.014","v0.012","v0.011","v0.010","v0.009","v0.004","v0.003"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-120212.json"}}],"schema_version":"1.9.2"}