CVE-2026-120643 PUBLISHED

CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url

Assigner: CPANSec
Reserved: 02.11.2026 Published: 03.11.2026 Updated: 03.11.2026

CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url.

Both pass the URL through URI's canonical method, which leaves an apostrophe in the path raw and decodes the %27 that query parameter escaping produces, so an apostrophe in the request path or a parameter appears raw in the result.

An application that places the URL in a single-quoted HTML attribute or JavaScript string is open to cross-site scripting.

Product Status

Package Collection https://cpan.org/modules
Package Name CGI
Versions Default: unaffected
  • affected from 4.62 to 5.00 (excl.)

Solutions

Upgrade to CGI 5.00 or later.

References

Problem Types

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE