Bug 2571180 (CVE-2026-120212)

Summary: CVE-2026-120212 perl-web-simple: Web::Simple: Cross-Site Scripting via unescaped single quotes in HTML attributes
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Web::Simple. A remote attacker can execute arbitrary script in a user's browser, leading to Cross-Site Scripting (XSS), by supplying untrusted input that is inserted into single-quoted HTML attributes. Because the component fails to escape single quotation marks when generating HTML tag output, malicious input can break out of the attribute and inject unauthorized script into the rendered web page.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-10 20:44:22 UTC 
Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output.

HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected.

An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.