Executive Summary

Template::Plugin::HTML versions prior to 3.103 for Perl fail to escape single quotes in the html_filter function, allowing attackers to inject limited HTML and JavaScript into attributes. For example, a value like " ' onclick='while(true){alert(1)}'" can be inserted into an attribute such as title='[% var | html %]', enabling XSS attacks. While angle brackets, ampersands, and double quotes remain escaped, the vulnerability still permits malicious script execution within single‑quoted attributes.

---

Authoritative CVE Metadata - CVSS Base Score: 6.1 (MEDIUM) - Published: 2026-05-19T22:16:39.003 - Last Modified: 2026-09-19T12:16:39.640

Original Description: Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected.

The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in

<a id='ref' title='[% var | html %]'>

would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example,

var = " ' onclick='while (true) { alert(1) }'"

Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.

"Success means having the courage, the determination, and the will to become the person you believe you were meant to be."

— George Sheehan