Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120212— Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output

Quick assessment

Affected
CVE-2026-120212
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 语言下，Web::Simple 0.037 之前的版本在生成 HTML::Tags 输出时，未对单引号进行转义。 HTML::Tags 和 XML::Tags 在转义普通字符串值时，仅将字符 、 、 和 替换为对应的实体。因此，若将某个值插值到单引号包裹的属性中（例如 ），攻击者可利用未转义的单引号提前结束该属性，并注入新的属性（如事件处理器）。双引号包裹的属性不受此问题影响。 若攻击者能够控制应用程序插值到单引号属性中的值，则可在生成的页面中注入恶意脚本。

AI Predicted 6.1 Difficulty: Easy EPSS 0.22% · P12

Possible ATT&CK Techniques 1 AI

T1059.007 · JavaScript

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 0.037 affected

I. Basic Information for CVE-2026-120212

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output
Source: CVE Program / CVE List V5
Vulnerability Description
Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output. HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected. An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 0.037 -

II. Public POCs for CVE-2026-120212

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120212

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-120212 (1)

Other References for CVE-2026-120212 (1)

Other References for CVE-2026-120212 (1)

IV. Related Vulnerabilities

Same weakness: CWE-79