Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-13051— Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_error as a Locale::Maketext template

Quick assessment

Affected
CVE-2026-13051
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 模块 在版本 0.06 至 1.162360 之间存在安全漏洞，攻击者可通过精心构造的 HTML 输入触发任意方法调用和资源耗尽。 该漏洞源于 方法对提交内容使用 进行验证，并将 返回的诊断信息（如错误消息）作为第一个参数传递给 方法。 进一步将这些消息作为语言句柄（Language Handle）中的 模板键进行处理。 默认语言句柄的词法配置启用了 选项。当某条消息未能在词法表中找到对应条目时，该消息不会作为普通字符串查找，而是被编译为带括号表示法（bracket notation）的模板。 在报告错误

AI Predicted 7.5 Difficulty: Easy EPSS 0.45% · P38

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None 0.06≤ 1.162360 affected

I. Basic Information for CVE-2026-13051

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_error as a Locale::Maketext template
Source: CVE Program / CVE List V5
Vulnerability Description
Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_error as a Locale::Maketext template. validate runs HTML::Tidy over the submitted markup and passes each resulting message to add_error as its first argument, which add_error hands to the language handle as the Locale::Maketext message key. The default handle's lexicon sets `_AUTO`, so a message that is not a lexicon entry is compiled as a bracket notation template instead of being looked up. Tidy diagnostics quote the offending attribute name or value, so a bracket group in the submitted markup reaches the template position, where the first token of the group names a method called on the language handle and the remaining tokens are its arguments. A group such as `[0]` makes the compile croak, and neither the field nor the handle catches it, so the exception leaves validate. `[sprintf,%2000000000d,7]` reaches CORE::sprintf with an attacker chosen field width. One submission of crafted markup to an HtmlArea field throws an unhandled exception out of form validation or allocates an arbitrary amount of memory, and an application whose language handle subclass defines side effecting public methods makes those callable with attacker chosen arguments. The other field types pass fixed templates with the submitted value in an argument slot, where it stays inert, and are unaffected.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1336
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0.06 ~ 1.162360 -

II. Public POCs for CVE-2026-13051

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-13051

请登录查看更多情报信息。

Other References for CVE-2026-13051 (1)

Other References for CVE-2026-13051 (1)

IV. Related Vulnerabilities

Same weakness: CWE-1336

V. Comments for CVE-2026-13051

No comments yet

Leave a comment