Is CVE-2026-114627 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114627 being exploited in the wild.

How severe is CVE-2026-114627?

Informational severity, published 4 November 2026.

Is there a fix for CVE-2026-114627?

Yes: fixed in 0.036. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114627 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114627?

Check whether you run Web::Simple at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114627: Web::Simple cross-site scripting in HTML::Tags string interpolation

CVE-2026-114627 · Severity: info · Published 2026-11-04

Web::Simple is a Perl web framework that uses HTML::Tags to generate web pages. When developers interpolate untrusted values into double-quoted HTML strings, those values are not entity-escaped, allowing attackers to inject malicious JavaScript code that executes in users' browsers when the page is viewed.

Quick answers

Is CVE-2026-114627 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114627 being exploited in the wild.
How severe is CVE-2026-114627?: Informational severity, published 4 November 2026.
Which products and versions are affected?: Web::Simple before 0.036.
Is there a fix for CVE-2026-114627?: Yes: fixed in 0.036. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114627 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114627?: Check whether you run Web::Simple at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.036

Technical details

Under HTML::Tags or XML::Tags, double-quoted string literals with interpolated variables create StringThing objects where parts are not entity-escaped during stringify, unlike unquoted values which are escaped. An attacker controlling interpolated values in expressions like "Hello $value" can inject arbitrary HTML/JavaScript. The fix applies XML entity escaping to all interpolated parts in the stringify method.

Affected products

Web::Simple before 0.036

Timeline

2026-11-04: disclosed
2026-10-31: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.