CVE-2026-120643

A flaw was found in perl-CGI. When constructing Uniform Resource Locators (URLs), the url() and self_url() functions fail to properly encode single quote characters in request paths or query parameters. A remote attacker can exploit this issue by submitting a crafted request to an application that embeds these URLs into single-quoted web page attributes or script blocks. This can result in cross-site scripting (XSS), allowing an attacker to execute malicious scripts in an affected user's browser and potentially access sensitive session data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.