{"id":"CVE-2026-5090","title":"Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected.\n\nThe html_filter function did not escape single quotes","summary":"Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected.\n\nThe html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected.  For example, t…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"product":"Template-Toolkit","affected":["Template-Toolkit < 3.103"],"published":"2026-05-19","updated":"2026-09-19","sourceUpdated":"2026-09-19T12:16:39.640","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-5090","references":[{"url":"https://github.com/abw/Template2/issues/327","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://github.com/cpan-authors/Template2/commit/ca539f49f6ffd1c2b7d9ef4f48f6b88292418734.patch","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/TODDR/Template-Toolkit-3.103/changes","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"http://www.openwall.com/lists/oss-security/2026/05/19/40","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-05-20T13:45:07.748170Z"},"epss":0.00292,"epssPercentile":0.22029,"ingestedAt":"2026-09-19T12:02:33.561Z","slug":"CVE-2026-5090","body":"## Overview\n\nTemplate::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected.\n\nThe html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected.  For example, the variable \"var\" in\n\n    <a id='ref' title='[% var | html %]'>\n\nwould not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example,\n\n    var = \" ' onclick='while (true) { alert(1) }'\"\n\nNote that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}