CVE-2026-114627: Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output

As cited

Copy frozen at 2026-11-04 17:44 UTC (site build).

vulnerabilities

CVE-2026-114627: Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output

CVE-2026-114627 affects Web::Simple, a Perl module for building web applications. The vulnerability exists in versions before 0.036, where values interpolated into double-quoted strings in HTML::Tags output are not properly escaped. This can lead to HTML injection or cross-site scripting (XSS) attacks when user input is rendered in HTML contexts.

Why it matters: Perl developers using Web::Simple before version 0.036 should upgrade immediately to prevent XSS vulnerabilities in web applications that process and display user-controlled data.

Source published

2026-11-04 16:00 UTC

First seen by Cybersecurity Tracker

2026-11-04 17:14 UTC