Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in <a id='ref' title='[% var | html %]'> would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example, var = " ' onclick='while (true) { alert(1) }'" Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-19 | 1 | General1 |
| 2026-05-20 | 1 | Disclosure1 |
Perl CPAN CVE-2026-5090: Template::Plugin::HTML through 3.102 allows HTML and JavaScript to be injected https://www.openwall.com/lists/oss-security/2026/05/19/40
Post summary
This advisory announces CVE‑2026‑5090, a vulnerability in Perl’s Template::Plugin::HTML that enables HTML/JavaScript injection, with no PoC, exploitation evidence, or patch information provided.
CVE-2026-5090 Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes. HTML attribute… https://www.cve.org/CVERecord?id=CVE-2026-5090
Post summary
The post describes CVE-2026-5090 as an injection flaw in Template::Plugin::HTML, noting lack of escaping for single quotes, but provides no PoC, exploit, or patch details.