{"affected":[{"defaultStatus":"unaffected","ecosystem":"cpan","packageName":"CGI","product":"","source":"CNA: CPANSec","vendor":"","versions":[{"lessThan":"5.00","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-120644","cwes":["CWE-116"],"description":"CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values.\n\nThe path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters.\n\nAn application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793749251418,"publishedAt":1793749251418,"references":[{"source":"CNA: CPANSec","tags":["technical-description"],"url":"https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI/Cookie.pm"},{"source":"CNA: CPANSec","tags":["release-notes"],"url":"https://metacpan.org/release/LEEJO/CGI-5.00/changes"},{"source":"CNA: CPANSec","tags":["patch"],"url":"https://github.com/leejo/CGI.pm/commit/0b3527faaa9de55f79ca7d59dd3bcfb2c5540e00.patch"}],"remediation":[{"kind":"fix","source":"CNA: CPANSec","text":"Upgrade to CGI 5.00 or later."},{"kind":"fix","source":"CNA: CPANSec","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/leejo/CGI.pm/commit/0b3527faaa9de55f79ca7d59dd3bcfb2c5540e00.patch"}],"revision":"322b24e4efe90c419fcfd42131dea19d6e269049a8cf95b113aa834da5ac5d2f","sources":[{"modifiedAt":1793749251418,"name":"CNA: CPANSec","retrievedAt":1793750983116,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120644"}],"ssvc":null,"status":"published","title":"CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values","updatedAt":1793750983116}