THREAT OPS › Threat News › [NVD] CVE-2026-5090 (MEDIUM 6.1) — Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected.
The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in
<a id='ref' title
[NVD] CVE-2026-5090 (MEDIUM 6.1) — Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in <a id='ref' title
CVE-2026-5090 CVSS: 6.1 MEDIUM Published: 2026-05-19T22:16:39.003
Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected.
The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in
<a id='ref' title='[% var | html %]'>
would not be properly escaped.
MITRE ATT&CK techniques
- JavaScriptT1059.007
Indicators of compromise
- CVE-2026-5090cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-5090