CVE-2026-120212: vulnerability in Web-Simple
Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
0Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Track
Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output.
HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected.
An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.
Affected products
Web-SimpleRelated CVEs — Web-Simple
In the same product, most dangerous first.
CVE-2026-114629HIGHWeb::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parametersEPSS 0.5%CVE-2026-114627MEDIUMWeb::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags outputEPSS 0.2%