Source: libweb-simple-perl Version: 0.035-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for libweb-simple-perl. CVE-2026-114627[0]: | Web::Simple versions before 0.036 for Perl do not escape values | interpolated into double-quoted strings in HTML::Tags output. Under | use HTML::Tags or use XML::Tags, a double-quoted string literal | becomes a StringThing object that holds each interpolated value as a | separate part. The escaping step passes such objects through, and | stringify joins their interpolated parts as is. A value passed on | its own, as in <p>, $value, </p>, is entity-escaped, but the same | value in "Hello $value" is not. An attacker who controls a value | that an application interpolates into a double-quoted string can | inject script into the generated page. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-114627 https://www.cve.org/CVERecord?id=CVE-2026-114627 [1] https://lists.security.metacpan.org/cve-announce/msg/44886751/ Please adjust the affected versions in the BTS as needed. Regards, Salvatore
