← All advisories

Unrated severityNVD Advisory· Published Nov 4, 2026

CVE-2026-120648

CVE-2026-120648

Description

CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment.

Arguments are placed between  without escaping, so text containing --> closes the comment early.

An application that passes request data to comment can be made to inject HTML into the page.

Affected products

2

Leejo/CGI.pmllm-create
Range: <5.00
Perl Foundation/CGI.pmllm-fuzzy
Range: <5.00

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.