CVE-2026-5090 Details
Description
Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in <a id='ref' title='[% var | html %]'> would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example, var = " ' onclick='while (true) { alert(1) }'" Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.
A vulnerability in the Template2 HTML plugin for Perl, affecting versions through 3.102, allows for Cross-Site Scripting (XSS) attacks by injecting HTML and JavaScript. The issue arises because the 'html_filter' function fails to properly escape single quotes, enabling code injection through HTML attributes. For instance, a variable containing a single quote could be injected into an attribute without proper sanitization. While the vulnerability primarily allows limited HTML and JavaScript injection, the exploitation of this flaw could be used to create more significant security issues, such as session hijacking or defacement.
Users can update to the latest version of Template2, where this vulnerability has been addressed. Instructions for updating can be found in the Template2 GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 19, 2026CISA-ADP
Assessed May 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/abw/Template2/issues/327 | CPANSec | Issue TrackingTechnical DescriptionVendor |
| https://github.com/cpan-authors/Template2/commit/ca539f49f6ffd1c2b7d9ef4f48f6b88292418734.patch | CPANSec | |
| https://metacpan.org/release/TODDR/Template-Toolkit-3.103/changes | CPANSec | |
| http://www.openwall.com/lists/oss-security/2026/05/19/40 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Template::Plugin::HTML | <= 3.102 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 19, 2026 | CVE Modified | CPANSec |
| Sep 19, 2026 | CVE Modified | CVE |
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 20, 2026 | CVE Modified | CISA-ADP |
| May 20, 2026 | CVE Modified | CVE |
| May 19, 2026 | New CVE Received | CPANSec |