CVE-2026-120648 PUBLISHED

CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment

Assigner: CPANSec
Reserved: 02.11.2026 Published: 03.11.2026 Updated: 03.11.2026

CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment.

Arguments are placed between without escaping, so text containing --> closes the comment early.

An application that passes request data to comment can be made to inject HTML into the page.

Product Status

Package Collection https://cpan.org/modules
Package Name CGI
Versions Default: unaffected
  • affected from 0 to 5.00 (excl.)

Solutions

Upgrade to CGI 5.00 or later.

References

Problem Types

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE