{"affected":[{"defaultStatus":"unaffected","ecosystem":"cpan","packageName":"Web-Simple","product":"","source":"CNA: CPANSec","vendor":"","versions":[{"lessThan":"0.036","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-114627","cwes":["CWE-79"],"description":"Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output.\n\nUnder use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step passes such objects through, and stringify joins their interpolated parts as is. A value passed on its own, as in <p>, $value, </p>, is entity-escaped, but the same value in \"Hello $value\" is not.\n\nAn attacker who controls a value that an application interpolates into a double-quoted string can inject script into the generated page.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793802673299,"publishedAt":1793802673299,"references":[{"source":"CNA: CPANSec","tags":["patch"],"url":"https://github.com/p5sagit/Web-Simple/commit/01e575827fdd9ba3a08063fd414b1de465380015.patch"},{"source":"CNA: CPANSec","tags":["release-notes"],"url":"https://metacpan.org/release/ETHER/Web-Simple-0.036/changes"}],"remediation":[{"kind":"fix","source":"CNA: CPANSec","text":"Upgrade to Web-Simple 0.036 or later."},{"kind":"fix","source":"CNA: CPANSec","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/p5sagit/Web-Simple/commit/01e575827fdd9ba3a08063fd414b1de465380015.patch"}],"revision":"67ac7dc3589969cc06136602c58bc49a956aa5a9f4899e939729f165ad7b1078","sources":[{"modifiedAt":1793802673299,"name":"CNA: CPANSec","retrievedAt":1793804983659,"url":"https://www.cve.org/CVERecord?id=CVE-2026-114627"}],"ssvc":null,"status":"published","title":"Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output","updatedAt":1793804983659}