CVE and update status of the FreeBSD ports tree3,627 unaddressed CVEs in 714 portsAll times are CET
CVE details

CVE-2026-114627

Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output. Under use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step passes such objects through, and stringify joins their interpolated parts as is. A value passed on its own, as in <p>, $value, </p>, is entity-escaped, but the same value in "Hello $value" is not. An attacker who controls a value that an application interpolates into a double-quoted string can inject script into the generated page.

Score
–
Published
2026-11-04
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
www/p5-Web-Simplep5-Web-Simple0.033unaddressedsunpoet@FreeBSD.org

Template for a VuXML entry

Check the content

Check the version numbers before you commit this entry. Some ports share an entry in the CVE database with another port, such as sqlite2 and sqlite3. The version shown here may then be one that never existed for this port.

Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.

No CPE in the port Makefile

www/p5-Web-Simple (CPE matched by the package name) has no USES=cpe. The CVE was matched through a CPE from another source, so the package and the version range may belong to a different product. Check the CVE record before using this entry.

  <vuln vid="FIXME (make newentry)">
    <topic>p5-Web-Simple -- FIXME</topic>
    <affects>
      <package>
	<name>p5-Web-Simple</name>
	<range><lt>0.036</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE-2026-114627: Web::Simple versions before 0.036 for Perl do not
	  escape values interpolated into double-quoted strings in HTML::Tags
	  output. Under use HTML::Tags or use XML::Tags, a double-quoted
	  string literal becomes a StringThing object that holds each
	  interpolated value as a separate part. The escaping step passes
	  such objects through, and stringify joins their interpolated parts
	  as is. A value passed on its own, as in &lt;p&gt;, $value, &lt;/p&gt;, is
	  entity-escaped, but the same value in "Hello $value" is not. An
	  attacker who controls a value that an application interpolates into
	  a double-quoted string can inject script into the generated page.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-114627</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-114627</url>
    </references>
    <dates>
      <discovery>2026-11-04</discovery>
      <entry>2026-11-04</entry>
    </dates>
  </vuln>