Cyber ·
CVE-2026-114627: Web::Simple before 0.036 does not escape values in HTML::Tags output
CPAN Security Group advisory, published November 4, 2026, for the Web-Simple distribution. Versions before 0.036 do not escape interpolated values inside double-quoted strings in HTML::Tags output.
Advisory CVE-2026-114627 states that Web::Simple, in versions before 0.036, does not escape interpolated values inside double-quoted strings when producing output with HTML::Tags. The item was republished from the oss-sec feed, attributed to Robert Rothenberg and dated November 4. The identifier is CVE-2026-114627, the distribution is Web-Simple, and the affected range is versions before 0.036. The source text cites the distribution page on MetaCPAN and a version control repository, but those addresses are not reproduced here. To verify the content, consult the original message on the oss-sec feed in the seclists archive, item 512 of the fourth quarter of 2026, and check the distribution page on MetaCPAN. Anyone maintaining code that uses Web-Simple should identify the installed version and assess the update following the recommendations in the advisory itself.