CVE-2026-5090 Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected
An attacker can inject limited HTML and JavaScript via unescaped single quotes in the html_filter function of the Perl Template::Plugin::HTML library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-5090?
CVE-2026-5090 is a medium-severity cross-site scripting vulnerability, published on 19 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected.
The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in
<a id='ref' title='[% var | html %]'>
would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example,
var = " ' onclick='while (true) { alert(1) }'"
Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.
Weakness: CWE-79
Which versions are affected by CVE-2026-5090?
How do I fix CVE-2026-5090?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-5090 being exploited?
There is no known exploitation of CVE-2026-5090 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-5090, GHSA-xhg9-j279-j625, MGASA-2026-0166, UBUNTU-CVE-2026-5090, USN-8377-1.