CVE-2026-120648— CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment

Quick assessment

Affected

CVE-2026-120648

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Perl 5.00 之前的 CGI 版本中，存在 HTML 注入漏洞：当注释内容中包含字符串时，攻击者可借此注入恶意 HTML。该漏洞的成因在于，CGI 模块将参数直接放置在和之间，且未对参数内容进行转义。因此，若传入的文本中包含，会导致注释提前闭合。任何将用户请求数据直接传递给注释字段的应用程序，都可能被利用来向页面注入任意 HTML 代码。

AI Predicted 6.1 Difficulty: Moderate Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Updated Nov 04, 2026

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment

Source: CVE Program / CVE List V5

Vulnerability Description

CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment. Arguments are placed between  without escaping, so text containing --> closes the comment early. An application that passes request data to comment can be made to inject HTML into the page.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	-	0 ~ 5.00	-

II. Public POCs for CVE-2026-120648

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120648

请登录查看更多情报信息。

Other References for CVE-2026-120648 (3)

https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm technical-description
https://metacpan.org/release/LEEJO/CGI-5.00/changes release-notes
https://github.com/leejo/CGI.pm/commit/6a17eb84703d84bca86b0079f5870ca9c921ffd4.patch patch

https://www.cve.org/CVERecord?id=CVE-2026-120648

IV. Related Vulnerabilities

Same weakness: CWE-79