CVE-2026-120643: vulnerability in CGI
CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.2%
CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url.
Both pass the URL through URI's canonical method, which leaves an apostrophe in the path raw and decodes the %27 that query parameter escaping produces, so an apostrophe in the request path or a parameter appears raw in the result.
An application that places the URL in a single-quoted HTML attribute or JavaScript string is open to cross-site scripting.
Affected products
CGIRelated CVEs — CGI
In the same product, most dangerous first.
CVE-2026-120645—CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_listEPSS 0.4%CVE-2026-120631—CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parseEPSS 0.4%CVE-2026-120639—CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_pushEPSS 0.2%CVE-2026-120636—CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_formEPSS 0.2%CVE-2026-120648—CGI versions before 5.00 for Perl allow HTML injection via text containing --> in commentEPSS 0.2%CVE-2026-120647—CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filenameEPSS 0.2%