Skip to content
Fencer Vulns
medium 6.1

CVE-2026-5090 json

Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected

published 2026-05-19 5 mo ago modified 2026-09-19 50 d ago also EUVD-2026-30995

cvss
6.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits
0
none known

Summary

Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected.

The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in

<a id='ref' title='[% var | html %]'>

would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example,

var = " ' onclick='while (true) { alert(1) }'"

Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.

Patch / fix

  • libtemplate-perl Debian 14 3.102-3

debian advisories DEBIAN-CVE-2026-5090

  • libtemplate-perl Ubuntu 22.04 LTS 2.27-1ubuntu0.22.04.1
  • libtemplate-perl Ubuntu 24.04 LTS 2.27-1ubuntu0.24.04.1
  • libtemplate-perl Ubuntu 25.10 2.27-1ubuntu0.25.10.1
  • libtemplate-perl Ubuntu 26.04 LTS 3.102-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2026-5090

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.