CVE-2026-5090
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A vulnerability in Template::Plugin::HTML for Perl through version 3.102 allows HTML and JavaScript injection. The html_filter function does not properly escape single quotes, allowing code injection in HTML attributes enclosed in single quotes.
Risk Assessment
An attacker can inject limited HTML and JavaScript, potentially leading to XSS attacks on users of templates containing untrusted data.
Recommendation
Update the Template::Plugin::HTML module to the latest available version that includes a fix for this vulnerability.
Original NVD description (English source)
Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in <a id='ref' title='[% var | html %]'> would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example, var = " ' onclick='while (true) { alert(1) }'" Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.