CVE-2026-120643 Details
Description
CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url. Both pass the URL through URI's canonical method, which leaves an apostrophe in the path raw and decodes the %27 that query parameter escaping produces, so an apostrophe in the request path or a parameter appears raw in the result. An application that places the URL in a single-quoted HTML attribute or JavaScript string is open to cross-site scripting.
A cross-site scripting vulnerability has been identified in Leejo CGI versions 4.62 prior to 5.00 for Perl. The issue arises when a raw apostrophe is included in URLs returned by the 'url' and 'self_url' methods. These methods process the URL through URI's canonicalization, which leaves the apostrophe in its raw form and decodes query parameter escapes. As a result, an apostrophe in the request path or a parameter is returned unencoded, creating a risk when the URL is placed in a single-quoted HTML attribute or JavaScript string.
Users are advised to upgrade to Leejo CGI version 5.00 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/leejo/CGI.pm/commit/851430be84c4d0f350681814e1d7718b9959f2c2.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm | CPANSec | Source CodeVendor |
| https://metacpan.org/release/LEEJO/CGI-5.00/changes | CPANSec | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| CGI | >= 4.62, < 5.00 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | CPANSec |