{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-114627","assignerOrgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","state":"PUBLISHED","assignerShortName":"CPANSec","dateReserved":"2026-10-21T21:43:01.842Z","datePublished":"2026-11-04T14:31:13.299Z","dateUpdated":"2026-11-04T18:05:41.509Z"},"containers":{"cna":{"affected":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["Web::Simple"],"packageName":"Web-Simple","packageURL":"pkg:cpan/Web-Simple","programFiles":["lib/XML/Tags.pm"],"programRoutines":[{"name":"XML::Tags::StringThing::stringify"}],"repo":"https://github.com/p5sagit/Web-Simple","versions":[{"lessThan":"0.036","status":"affected","version":"0","versionType":"custom"}]}],"descriptions":[{"lang":"en","value":"Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output.\n\nUnder use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step passes such objects through, and stringify joins their interpolated parts as is. A value passed on its own, as in <p>, $value, </p>, is entity-escaped, but the same value in \"Hello $value\" is not.\n\nAn attacker who controls a value that an application interpolates into a double-quoted string can inject script into the generated page."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","shortName":"CPANSec","dateUpdated":"2026-11-04T14:31:13.299Z"},"references":[{"tags":["patch"],"url":"https://github.com/p5sagit/Web-Simple/commit/01e575827fdd9ba3a08063fd414b1de465380015.patch"},{"tags":["release-notes"],"url":"https://metacpan.org/release/ETHER/Web-Simple-0.036/changes"}],"solutions":[{"lang":"en","value":"Upgrade to Web-Simple 0.036 or later."}],"source":{"discovery":"UNKNOWN"},"title":"Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output","x_generator":{"engine":"cpansec-cna-tool 0.1"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/11/04/5"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-11-04T18:05:41.509Z"}}]}}