Every CVE Search/ Get API key

CVE-2026-120636

CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form

No score

CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form.

url(-absolute=>1), url(-relative=>1) and the default start_form action are built from the client-supplied REQUEST_URI without validation. The result can be protocol-relative (//evil.example), absolute-form (http://evil.example/) or contain backslashes, and url(-relative=>1) can return a javascript: URL. Links and form posts built from these URLs can go to another host.

Exploit likelihood

0.21%Unchanged since Nov 4, 2026
90%50%10%1%

What each source reports

CVE List No score

CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form

CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form.

url(-absolute=>1), url(-relative=>1) and the default start_form action are built from the client-supplied REQUEST_URI without validation. The result can be protocol-relative (//evil.example), absolute-form (http://evil.example/) or contain backslashes, and url(-relative=>1) can return a javascript: URL. Links and form posts built from these URLs can go to another host.

Record
CVE-2026-120636
Weakness
CWE-601, CWE-79
Updated
2026-11-04
EUVDEUVD-2026-116603 No score

CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form.

url(-absolute=>1), url(-relative=>1) and the default start_form action are built from the client-supplied REQUEST_URI without validation. The result can be protocol-relative (//evil.example), absolute-form (http://evil.example/) or contain backslashes, and url(-relative=>1) can return a javascript: URL. Links and form posts built from these URLs can go to another host.

Record
EUVD-2026-116603
Updated
2026-11-04
GitHub AdvisoriesGHSA-7432-xjrv-h264 No score

CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from...

CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form.

url(-absolute=>1), url(-relative=>1) and the default start_form action are built from the client-supplied REQUEST_URI without validation. The result can be protocol-relative (//evil.example), absolute-form (http://evil.example/) or contain backslashes, and url(-relative=>1) can return a javascript: URL. Links and form posts built from these URLs can go to another host.

Record
GHSA-7432-xjrv-h264
Weakness
CWE-79
Updated
2026-11-04
NVD No score

CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form.

url(-absolute=>1), url(-relative=>1) and the default start_form action are built from the client-supplied REQUEST_URI without validation. The result can be protocol-relative (//evil.example), absolute-form (http://evil.example/) or contain backslashes, and url(-relative=>1) can return a javascript: URL. Links and form posts built from these URLs can go to another host.

Record
CVE-2026-120636
Weakness
CWE-79, CWE-601
Updated
2026-11-04
OSVAZL-112765 No score

CVE-2026-120636 affecting package perl-CGI 4.60-1

CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form.

url(-absolute=>1), url(-relative=>1) and the default start_form action are built from the client-supplied REQUEST_URI without validation. The result can be protocol-relative (//evil.example), absolute-form (http://evil.example/) or contain backslashes, and url(-relative=>1) can return a javascript: URL. Links and form posts built from these URLs can go to another host.

Record
AZL-112765
Updated
2026-11-07
OSV No score

CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form

CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form.

url(-absolute=>1), url(-relative=>1) and the default start_form action are built from the client-supplied REQUEST_URI without validation. The result can be protocol-relative (//evil.example), absolute-form (http://evil.example/) or contain backslashes, and url(-relative=>1) can return a javascript: URL. Links and form posts built from these URLs can go to another host.

Record
CVE-2026-120636
Weakness
CWE-601, CWE-79
Updated
2026-11-07
OSVDEBIAN-CVE-2026-120636 No score

CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form. url(-absolute=>1), url(-relative=>1) and the default start_form action are built from the client-supplied REQUEST_URI without validation. The result can be protocol-relative (//evil.example), absolute-form (http://evil.example/) or contain backslashes, and url(-relative=>1) can return a javascript: URL. Links and form posts built from these URLs can go to another host.

Record
DEBIAN-CVE-2026-120636
Updated
2026-11-05
OSVopenSUSE-SU-2026:12465-1 No score

perl-CGI-5.20.0-1.1 on GA media

These are all security issues fixed in the perl-CGI-5.20.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12465-1
Updated
2026-11-07
OSVUBUNTU-CVE-2026-120636 No score

CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form. url(-absolute=>1), url(-relative=>1) and the default start_form action are built from the client-supplied REQUEST_URI without validation. The result can be protocol-relative (//evil.example), absolute-form (http://evil.example/) or contain backslashes, and url(-relative=>1) can return a javascript: URL. Links and form posts built from these URLs can go to another host.

Record
UBUNTU-CVE-2026-120636
Updated
2026-11-05

Affected packages

Affected packages
PackageAffectedFixed
perl-CGI
Azure Linux:3
 through 4.60-1 None known
libcgi-pm-perl
Debian:12
 All versions, plus listed versions
4.55-14.57-14.59-14.60-14.61-1
Show 11 moreShow less
4.62-14.63-14.64-14.65-14.66-14.67-14.68-14.70-14.71-14.72-15.02-1
 None known
libcgi-pm-perl
Debian:13
 All versions, plus listed versions
4.68-14.70-14.71-14.72-15.02-1
 None known
libcgi-pm-perl
Debian:14
 All versions, plus listed versions
4.68-14.70-14.71-14.72-15.02-1
 None known
libcgi-pm-perl
Ubuntu:16.04:LTS
 All versions, plus listed versions
4.21-14.22-14.25-14.26-1
 None known
libcgi-pm-perl
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.36-14.37-14.38-1
 None known
libcgi-pm-perl
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.44-14.45-14.46-1
 None known
libcgi-pm-perl
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.51-14.53-14.54-1
 None known
libcgi-pm-perl
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.57-14.60-14.61-14.62-14.63-1
 None known
libcgi-pm-perl
Ubuntu:26.10
 All versions, plus listed versions
4.71-1build14.72-1
 None known
libcgi-pm-perl
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.68-14.71-14.71-1build1
 None known
perl-CGI
openSUSE:Tumbleweed
From an advisory covering 20 CVEs
 before 5.20.0-1.1
5.20.0-1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, aliases, referencesOSV
affected, aliases, referencesNVD, OSV
referencesOSV
affected, aliases, referencesOSV
aliasesEUVD, NVD
first indexedCVE List, GitHub Advisories

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-120636 is a vulnerability with no CVSS score yet in perl-CGI, published November 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. No source names a fixed version.

References

Show 27 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open