CVE-2026-120212

Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output. HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", with entities. A value interpolated into a single-quoted attribute, as in , can therefore close the attribute and add new ones,...