{"id":"CVE-2026-114627","title":"Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output","summary":"Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output.\n\nUnder use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds …","severity":"none","cwe":["CWE-79"],"product":"Web-Simple","affected":["Web-Simple < 0.036"],"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T18:05:41.509Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114627","references":[{"url":"https://github.com/p5sagit/Web-Simple/commit/01e575827fdd9ba3a08063fd414b1de465380015.patch"},{"url":"https://metacpan.org/release/ETHER/Web-Simple-0.036/changes"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T21:36:00.477Z","epss":0.00227,"epssPercentile":0.13529,"slug":"CVE-2026-114627","body":"## Overview\n\nWeb::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output.\n\nUnder use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step passes such objects through, and stringify joins their interpolated parts as is. A value passed on its own, as in <p>, $value, </p>, is entity-escaped, but the same value in \"Hello $value\" is not.\n\nAn attacker who controls a value that an application interpolates into a double-quoted string can inject script into the generated page.\n\n## Affected\n\n- `Web-Simple < 0.036`\n\n## Remediation\n\nUpgrade to Web-Simple 0.036 or later.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}