CVE-2026-120643 CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url

CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and selfurl. Both pass the URL through URI's canonical method, which leaves an apostrophe in the path raw and decodes the %27 that query parameter escaping produces, so an apostroph...

CVE-2026-120643

A vulnerability exists in perl-CGI (versions 4.62 before 5.00) where the url() and self_url() functions fail to properly encode single quote characters in request paths or query parameters. The functions pass the URL through a canonical method that leaves apostrophes raw and decodes %27 sequences...