---
id: CVE-2026-5090
title: >-
  Template::Plugin::HTML versions before 3.103 for Perl allows HTML and
  JavaScript to be injected.


  The html_filter function did not escape single quotes
summary: >-
  Template::Plugin::HTML versions before 3.103 for Perl allows HTML and
  JavaScript to be injected.


  The html_filter function did not escape single quotes. HTML attributes inside
  of single quotes could be have code injected.  For example, t…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
product: Template-Toolkit
affected:
  - Template-Toolkit < 3.103
published: '2026-05-19'
updated: '2026-09-19'
sourceUpdated: '2026-09-19T12:16:39.640'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-5090'
references:
  - url: 'https://github.com/abw/Template2/issues/327'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: >-
      https://github.com/cpan-authors/Template2/commit/ca539f49f6ffd1c2b7d9ef4f48f6b88292418734.patch
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'https://metacpan.org/release/TODDR/Template-Toolkit-3.103/changes'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'http://www.openwall.com/lists/oss-security/2026/05/19/40'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-05-20T13:45:07.748170Z'
epss: 0.00292
epssPercentile: 0.22031
ingestedAt: '2026-09-19T12:02:33.561Z'
---

## Overview

Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected.

The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected.  For example, the variable "var" in

    <a id='ref' title='[% var | html %]'>

would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example,

    var = " ' onclick='while (true) { alert(1) }'"

Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.