Bug#1153059: libweb-simple-perl: CVE-2026-114627

[Salvatore Bonaccorso]

Source: libweb-simple-perl
Version: 0.035-1
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for libweb-simple-perl.

CVE-2026-114627[0]:
| Web::Simple versions before 0.036 for Perl do not escape values
| interpolated into double-quoted strings in HTML::Tags output.  Under
| use HTML::Tags or use XML::Tags, a double-quoted string literal
| becomes a StringThing object that holds each interpolated value as a
| separate part. The escaping step passes such objects through, and
| stringify joins their interpolated parts as is. A value passed on
| its own, as in <p>, $value, </p>, is entity-escaped, but the same
| value in "Hello $value" is not.  An attacker who controls a value
| that an application interpolates into a double-quoted string can
| inject script into the generated page.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-114627
    https://www.cve.org/CVERecord?id=CVE-2026-114627
[1] https://lists.security.metacpan.org/cve-announce/msg/44886751/

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore