CVE-2026-5090
Severity CVSS v4.0:
Pending analysis
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
19/05/2026
Last modified:
20/05/2026
Description
Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected.<br />
<br />
The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in<br />
<br />
<br />
<br />
would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example,<br />
<br />
var = " &#39; onclick=&#39;while (true) { alert(1) }&#39;"<br />
<br />
Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.
Impact
Base Score 3.x
6.10
Severity 3.x
MEDIUM