CVE-2026-114627

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114627", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-10-21T21:43:01.842Z", "datePublished": "2026-11-04T14:31:13.299Z", "dateUpdated": "2026-11-10T12:41:13.609Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Web::Simple"], "packageName": "Web-Simple", "packageURL": "pkg:cpan/Web-Simple", "programFiles": ["lib/XML/Tags.pm"], "programRoutines": [{"name": "XML::Tags::StringThing::stringify"}], "repo": "https://github.com/p5sagit/Web-Simple", "versions": [{"lessThan": "0.036", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output.\n\nUnder use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step passes such objects through, and stringify joins their interpolated parts as is. A value passed on its own, as in <p>, $value, </p>, is entity-escaped, but the same value in \"Hello $value\" is not.\n\nAn attacker who controls a value that an application interpolates into a double-quoted string can inject script into the generated page."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-11-04T14:31:13.299Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/p5sagit/Web-Simple/commit/01e575827fdd9ba3a08063fd414b1de465380015.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/ETHER/Web-Simple-0.036/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to Web-Simple 0.036 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/04/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-04T18:05:41.509Z"}}, {"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-10T12:40:58.429963Z", "id": "CVE-2026-114627", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T12:41:13.609Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/04/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-04T18:05:41.509Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-114627", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-10T12:40:58.429963Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T12:40:47.326Z"}}], "cna": {"title": "Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/p5sagit/Web-Simple", "modules": ["Web::Simple"], "versions": [{"status": "affected", "version": "0", "lessThan": "0.036", "versionType": "custom"}], "packageURL": "pkg:cpan/Web-Simple", "packageName": "Web-Simple", "programFiles": ["lib/XML/Tags.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "XML::Tags::StringThing::stringify"}]}], "solutions": [{"lang": "en", "value": "Upgrade to Web-Simple 0.036 or later."}], "references": [{"url": "https://github.com/p5sagit/Web-Simple/commit/01e575827fdd9ba3a08063fd414b1de465380015.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/ETHER/Web-Simple-0.036/changes", "tags": ["release-notes"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output.\n\nUnder use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step passes such objects through, and stringify joins their interpolated parts as is. A value passed on its own, as in <p>, $value, </p>, is entity-escaped, but the same value in \"Hello $value\" is not.\n\nAn attacker who controls a value that an application interpolates into a double-quoted string can inject script into the generated page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-11-04T14:31:13.299Z"}}}, "cveMetadata": {"cveId": "CVE-2026-114627", "state": "PUBLISHED", "dateUpdated": "2026-11-10T12:41:13.609Z", "dateReserved": "2026-10-21T21:43:01.842Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-11-04T14:31:13.299Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Web::Simple"], "packageName": "Web-Simple", "packageURL": "pkg:cpan/Web-Simple", "programFiles": ["lib/XML/Tags.pm"], "programRoutines": [{"name": "XML::Tags::StringThing::stringify"}], "repo": "https://github.com/p5sagit/Web-Simple", "versions": [{"lessThan": "0.036", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output.\n\nUnder use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step passes such objects through, and stringify joins their interpolated parts as is. A value passed on its own, as in <p>, $value, </p>, is entity-escaped, but the same value in \"Hello $value\" is not.\n\nAn attacker who controls a value that an application interpolates into a double-quoted string can inject script into the generated page."}], "id": "CVE-2026-114627", "lastModified": "2026-11-12T20:07:11.090", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-114627", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-10T12:40:58.429963Z", "version": "2.0.3"}}]}, "published": "2026-11-04T15:17:35.167", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/p5sagit/Web-Simple/commit/01e575827fdd9ba3a08063fd414b1de465380015.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/ETHER/Web-Simple-0.036/changes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/11/04/5"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-web-simple: Web::Simple: Cross-Site Scripting via unescaped string interpolation", "id": "2566999", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566999"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output.\nUnder use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step passes such objects through, and stringify joins their interpolated parts as is. A value passed on its own, as in <p>, $value, </p>, is entity-escaped, but the same value in \"Hello $value\" is not.\nAn attacker who controls a value that an application interpolates into a double-quoted string can inject script into the generated page.", "A flaw was found in Web::Simple. A remote attacker could conduct a Cross-Site Scripting (XSS) attack by supplying malicious input that is interpolated into double-quoted strings during HTML or XML tag generation. Because the component does not properly escape these interpolated values, an attacker can execute arbitrary script in the context of the user's browser session."], "name": "CVE-2026-114627", "public_date": "2026-11-04T14:31:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114627\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114627\nhttps://github.com/p5sagit/Web-Simple/commit/01e575827fdd9ba3a08063fd414b1de465380015.patch\nhttps://metacpan.org/release/ETHER/Web-Simple-0.036/changes"], "threat_severity": "Moderate"}

{"created": "2026-11-04T15:30:09.213174+00:00", "updated": "2026-11-06T02:15:18.137211+00:00", "vendors": []}