CVE-2026-120212 Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-120212?
CVE-2026-120212 is a vulnerability, published on 10 Nov 2026.
Official description
Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output.
HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected.
An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.
Weakness: CWE-79
Which versions are affected by CVE-2026-120212?
How do I fix CVE-2026-120212?
No fix has been published for CVE-2026-120212 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-120212 being exploited?
There is no known exploitation of CVE-2026-120212 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-120212, GHSA-3xh6-x477-72h3, UBUNTU-CVE-2026-120212.