{"affected":[{"defaultStatus":"unaffected","ecosystem":"cpan","packageName":"CGI","product":"","source":"CNA: CPANSec","vendor":"","versions":[{"lessThan":"5.00","status":"affected","version":"4.62","versionType":"custom"}]}],"cveId":"CVE-2026-120643","cwes":["CWE-79"],"description":"CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url.\n\nBoth pass the URL through URI's canonical method, which leaves an apostrophe in the path raw and decodes the %27 that query parameter escaping produces, so an apostrophe in the request path or a parameter appears raw in the result.\n\nAn application that places the URL in a single-quoted HTML attribute or JavaScript string is open to cross-site scripting.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793749248770,"publishedAt":1793749248770,"references":[{"source":"CNA: CPANSec","tags":["technical-description"],"url":"https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm"},{"source":"CNA: CPANSec","tags":["release-notes"],"url":"https://metacpan.org/release/LEEJO/CGI-5.00/changes"},{"source":"CNA: CPANSec","tags":["patch"],"url":"https://github.com/leejo/CGI.pm/commit/851430be84c4d0f350681814e1d7718b9959f2c2.patch"}],"remediation":[{"kind":"fix","source":"CNA: CPANSec","text":"Upgrade to CGI 5.00 or later."},{"kind":"fix","source":"CNA: CPANSec","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/leejo/CGI.pm/commit/851430be84c4d0f350681814e1d7718b9959f2c2.patch"}],"revision":"914b62ca08db697d344eb2a97001f824a5240d6b3e501447ccfb8c0cc8881c7b","sources":[{"modifiedAt":1793749248770,"name":"CNA: CPANSec","retrievedAt":1793750981982,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120643"}],"ssvc":null,"status":"published","title":"CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url","updatedAt":1793750981982}