Description
Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in <a id='ref' title='[% var | html %]'> would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example, var = " ' onclick='while (true) { alert(1) }'" Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.
Problem types
CWE-79 Improper Neutralization of Input During Web Page Generation
Product status
Any version
Timeline
| 2024-12-01: | Issue reported in GitHub. |
| 2026-02-21: | Pull request submitted. |
| 2026-03-22: | Pull request merged. |
| 2026-03-22: | Issue reported to CPANSec. |
| 2026-03-28: | CVE assigned. |
References
www.openwall.com/lists/oss-security/2026/05/19/40
github.com/abw/Template2/issues/327
github.com/...anges/11c78a7a771d4af505efeb754a0b8775689c2eae