Under use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step passes such objects through, and stringify joins their interpolated parts as is. A value passed on its own, as in <p>, $value, </p>, is entity-escaped, but the same value in "Hello $value" is not.
An attacker who controls a value that an application interpolates into a double-quoted string can inject script into the generated page.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
Upgrade to Web-Simple 0.036 or later.
Workaround
No workaround given by the vendor.
Wed, 04 Nov 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output. Under use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step passes such objects through, and stringify joins their interpolated parts as is. A value passed on its own, as in <p>, $value, </p>, is entity-escaped, but the same value in "Hello $value" is not. An attacker who controls a value that an application interpolates into a double-quoted string can inject script into the generated page. | |
| Title | Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output | |
| Weaknesses | CWE-79 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-11-04T14:31:13.299Z
Reserved: 2026-10-21T21:43:01.842Z
Link: CVE-2026-114627
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-04T15:17:35.167
Modified: 2026-11-04T15:17:35.167
Link: CVE-2026-114627
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-04T15:30:09Z