{"id":"CVE-2026-5090","aliases":["DEBIAN-CVE-2026-5090","EUVD-2026-30995","GHSA-xhg9-j279-j625","MGASA-2026-0166","UBUNTU-CVE-2026-5090","USN-8377-1"],"status":"published","title":"Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected","description":"Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected.\n\nThe html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected.  For example, the variable \"var\" in\n\n    \u003ca id='ref' title='[% var | html %]'\u003e\n\nwould not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example,\n\n    var = \" ' onclick='while (true) { alert(1) }'\"\n\nNote that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00292,"percentile":0.22033,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-05-19T21:30:03Z","modified":"2026-10-28T02:30:21Z","fixes":[{"ecosystem":"Debian:14","package":"libtemplate-perl","fixed_in":["3.102-3"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"perl-Template-Toolkit","fixed_in":["3.101.0-1.1.mga9"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libtemplate-perl","fixed_in":["2.27-1ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libtemplate-perl","fixed_in":["2.27-1ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libtemplate-perl","fixed_in":["2.27-1ubuntu0.25.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libtemplate-perl","fixed_in":["3.102-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libtemplate-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.27-1","3.102-1","3.102-2","3.102-3","3.106-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libtemplate-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.27-1","3.102-1","3.102-2","3.102-3","3.106-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libtemplate-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.102-3"}]}],"versions":["2.27-1","3.102-1","3.102-2"]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-Template-Toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.101.0-1.1.mga9"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libtemplate-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.24-1.2build1","2.24-1.2build2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libtemplate-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.24-1.2build5","2.27-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libtemplate-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.27-1build1","2.27-1build2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libtemplate-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27-1ubuntu0.22.04.1"}]}],"versions":["2.27-1build4","2.27-1build5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libtemplate-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27-1ubuntu0.24.04.1"}]}],"versions":["2.27-1build7","2.27-1build8","2.27-1build9","2.27-1build10"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libtemplate-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27-1ubuntu0.25.10.1"}]}],"versions":["2.27-1build11"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libtemplate-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.102-1ubuntu0.1"}]}],"versions":["2.27-1build11","3.102-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libtemplate-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27-1ubuntu0.22.04.1"}]}],"versions":["2.27-1build4","2.27-1build5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libtemplate-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27-1ubuntu0.24.04.1"}]}],"versions":["2.27-1build7","2.27-1build8","2.27-1build9","2.27-1build10"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libtemplate-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27-1ubuntu0.25.10.1"}]}],"versions":["2.27-1build11"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libtemplate-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.102-1ubuntu0.1"}]}],"versions":["2.27-1build11","3.102-1"]}],"references":[{"url":"https://github.com/abw/Template2/issues/327","tags":["issue-tracking","report"]},{"url":"https://github.com/cpan-authors/Template2/commit/ca539f49f6ffd1c2b7d9ef4f48f6b88292418734.patch","tags":["patch","fix"]},{"url":"https://metacpan.org/release/TODDR/Template-Toolkit-3.103/changes","tags":["release-notes","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/19/40","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5090","tags":["advisory"]},{"url":"https://github.com/abw/Template2/pull/337/changes/11c78a7a771d4af505efeb754a0b8775689c2eae","tags":["report"]},{"url":"https://github.com/advisories/GHSA-xhg9-j279-j625"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5090.json","tags":["advisory"]},{"url":"https://github.com/abw/Template2","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-5090","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0166.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35554","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/19/40","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-5090","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5090","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/40218729/","tags":["report"]},{"url":"https://github.com/cpan-authors/Template2/pull/337","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8377-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-5090","title":"Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected","description":"Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected.\n\nThe html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected.  For example, the variable \"var\" in\n\n    \u003ca id='ref' title='[% var | html %]'\u003e\n\nwould not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example,\n\n    var = \" ' onclick='while (true) { alert(1) }'\"\n\nNote that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.","status":"published","published":"2026-05-19T21:30:03.552Z","modified":"2026-09-19T11:46:35.655Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:39:27.849196Z"}],"euvd":[{"id":"EUVD-2026-30995","description":"Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected.\n\nThe html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected.  For example, the variable \"var\" in\n\n    \u003ca id='ref' title='[% var | html %]'\u003e\n\nwould not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example,\n\n    var = \" ' onclick='while (true) { alert(1) }'\"\n\nNote that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.","status":"published","published":"2026-05-19T21:30:03Z","modified":"2026-09-19T11:46:35Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:06.992666Z"}],"ghsa":[{"id":"GHSA-xhg9-j279-j625","title":"Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected....","description":"Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected.\n\nThe html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected.  For example, the variable \"var\" in\n\n    \u003ca id='ref' title='[% var | html %]'\u003e\n\nwould not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example,\n\n    var = \" ' onclick='while (true) { alert(1) }'\"\n\nNote that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.","status":"published","published":"2026-05-20T00:31:42Z","modified":"2026-09-19T12:32:11Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:12:13.368323Z"}],"nvd":[{"id":"CVE-2026-5090","description":"Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected.\n\nThe html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected.  For example, the variable \"var\" in\n\n    \u003ca id='ref' title='[% var | html %]'\u003e\n\nwould not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example,\n\n    var = \" ' onclick='while (true) { alert(1) }'\"\n\nNote that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.","status":"published","published":"2026-05-19T22:16:39.003Z","modified":"2026-09-19T12:16:39.64Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:19.752984Z"}],"osv":[{"id":"CVE-2026-5090","title":"Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected","description":"Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected.\n\nThe html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected.  For example, the variable \"var\" in\n\n    \u003ca id='ref' title='[% var | html %]'\u003e\n\nwould not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example,\n\n    var = \" ' onclick='while (true) { alert(1) }'\"\n\nNote that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.","status":"published","published":"2026-05-19T21:30:03.552Z","modified":"2026-10-28T02:30:21.59045652Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:07.431113Z"},{"id":"DEBIAN-CVE-2026-5090","description":"Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected.  The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected.  For example, the variable \"var\" in      \u003ca id='ref' title='[% var | html %]'\u003e  would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example,      var = \" ' onclick='while (true) { alert(1) }'\"  Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.","status":"published","published":"2026-05-19T22:16:39.003Z","modified":"2026-10-01T03:03:16.739923638Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:56.877408Z"},{"id":"UBUNTU-CVE-2026-5090","description":"Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected.  For example, the variable \"var\" in     \u003ca id='ref' title='[% var | html %]'\u003e would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example,     var = \" ' onclick='while (true) { alert(1) }'\" Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.","status":"published","published":"2026-05-19T22:16:00Z","modified":"2026-09-24T02:00:33.207746813Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"MGASA-2026-0166","title":"Updated perl-Template-Toolkit packages fix security vulnerability","description":"Template::Plugin::HTML versions through 3.102 for Perl allows HTML and\nJavaScript to be injected. (CVE-2026-5090)\n","status":"published","published":"2026-05-30T05:07:56Z","modified":"2026-05-30T05:15:04.420885302Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"USN-8377-1","title":"libtemplate-perl vulnerability","description":"It was discovered that Template-Toolkit did not properly escape single\nquotes in the html_filter function of Template::Plugin::HTML. An attacker\ncould possibly use this issue to inject arbitrary HTML and JavaScript into\ngenerated output.","status":"published","published":"2026-06-03T13:24:32Z","modified":"2026-06-03T22:18:10.884600054Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}