CVE-2026-5090: medium-severity vulnerability in Template-Toolkit
Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 0.3%
exploitation probability
0.3%top 75% of all CVEs
observed exploitation
nono source reports it
Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected.
The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in
<a id='ref' title='[% var | html %]'>
would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example,
var = " ' onclick='while (true) { alert(1) }'"
Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Template-Toolkit