CVE-2026-13051— Perl Form::Processor 0.06-1.162360 远程代码执行漏洞
一分钟漏洞结论
影响对象
CVE-2026-13051
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Perl 模块 在版本 0.06 至 1.162360 之间存在安全漏洞，攻击者可通过精心构造的 HTML 输入触发任意方法调用和资源耗尽。 该漏洞源于 方法对提交内容使用 进行验证，并将 返回的诊断信息（如错误消息）作为第一个参数传递给 方法。 进一步将这些消息作为语言句柄（Language Handle）中的 模板键进行处理。 默认语言句柄的词法配置启用了 选项。当某条消息未能在词法表中找到对应条目时，该消息不会作为普通字符串查找，而是被编译为带括号表示法（bracket notation）的模板。 在报告错误
一、 漏洞 CVE-2026-13051 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_error as a Locale::Maketext template
来源: CVE Program / CVE List V5
Vulnerability Description
Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_error as a Locale::Maketext template.
validate runs HTML::Tidy over the submitted markup and passes each resulting message to add_error as its first argument, which add_error hands to the language handle as the Locale::Maketext message key. The default handle's lexicon sets `_AUTO`, so a message that is not a lexicon entry is compiled as a bracket notation template instead of being looked up. Tidy diagnostics quote the offending attribute name or value, so a bracket group in the submitted markup reaches the template position, where the first token of the group names a method called on the language handle and the remaining tokens are its arguments. A group such as `[0]` makes the compile croak, and neither the field nor the handle catches it, so the exception leaves validate. `[sprintf,%2000000000d,7]` reaches CORE::sprintf with an attacker chosen field width.
One submission of crafted markup to an HtmlArea field throws an unhandled exception out of form validation or allocates an arbitrary amount of memory, and an application whose language handle subclass defines side effecting public methods makes those callable with attacker chosen arguments. The other field types pass fixed templates with the submitted value in an argument slot, where it stays inert, and are unaffected.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
CWE-1336
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| - | - | 0.06 ~ 1.162360 | - |
|
二、漏洞 CVE-2026-13051 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-13051 的情报信息
请登录查看更多情报信息。
CVE-2026-13051 其他参考 (1)
CVE-2026-13051 其他参考 (1)
IV. Related Vulnerabilities
V. Comments for CVE-2026-13051
暂无评论