Under use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step passes such objects through, and stringify joins their interpolated parts as is. A value passed on its own, as in <p>, $value, </p>, is entity-escaped, but the same value in "Hello $value" is not.
An attacker who controls a value that an application interpolates into a double-quoted string can inject script into the generated page.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to Web-Simple 0.036 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 04 Nov 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output. Under use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step passes such objects through, and stringify joins their interpolated parts as is. A value passed on its own, as in <p>, $value, </p>, is entity-escaped, but the same value in "Hello $value" is not. An attacker who controls a value that an application interpolates into a double-quoted string can inject script into the generated page. | |
| Title | Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output | |
| Weaknesses | CWE-79 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-11-04T14:31:13.299Z
Reserved: 2026-10-21T21:43:01.842Z
Link: CVE-2026-114627
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-04T15:17:35.167
Modified: 2026-11-04T15:17:35.167
Link: CVE-2026-114627
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-04T15:30:09Z
-
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')