{"id":"CVE-2026-120644","title":"CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values","summary":"CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values.\n\nThe path, domain and expires values are written into the Set-Cookie header without checking for semicolons or co…","severity":"none","cwe":["CWE-116"],"product":"CGI","affected":["CGI < 5.00"],"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T23:40:51.418Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120644","references":[{"url":"https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI/Cookie.pm"},{"url":"https://metacpan.org/release/LEEJO/CGI-5.00/changes"},{"url":"https://github.com/leejo/CGI.pm/commit/0b3527faaa9de55f79ca7d59dd3bcfb2c5540e00.patch"}],"tags":["cve.org"],"epss":0.00205,"epssPercentile":0.10597,"ingestedAt":"2026-11-05T20:33:06.618Z","slug":"CVE-2026-120644","body":"## Overview\n\nCGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values.\n\nThe path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters.\n\nAn application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.\n\n## Affected\n\n- `CGI < 5.00`\n\n## Remediation\n\nUpgrade to CGI 5.00 or later.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}