# CVE-2026-114627: Web::Simple cross-site scripting in HTML::Tags string interpolation

Source: https://junglewise.ai/threats/cve-2026-114627-web-simple-versions-before-0-036-for-perl-do-not-escape-values  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-114627 · Severity: info · Published 2026-11-04

Web::Simple is a Perl web framework that uses HTML::Tags to generate web pages. When developers interpolate untrusted values into double-quoted HTML strings, those values are not entity-escaped, allowing attackers to inject malicious JavaScript code that executes in users' browsers when the page is viewed.

## Quick answers

**Is CVE-2026-114627 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114627 being exploited in the wild.

**How severe is CVE-2026-114627?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** Web::Simple before 0.036.

**Is there a fix for CVE-2026-114627?** Yes: fixed in 0.036. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114627 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114627?** Check whether you run Web::Simple at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.036

## Technical details

Under HTML::Tags or XML::Tags, double-quoted string literals with interpolated variables create StringThing objects where parts are not entity-escaped during stringify, unlike unquoted values which are escaped. An attacker controlling interpolated values in expressions like "Hello $value" can inject arbitrary HTML/JavaScript. The fix applies XML entity escaping to all interpolated parts in the stringify method.

## Affected products

- Web::Simple before 0.036

## Timeline

- 2026-11-04: disclosed
- 2026-10-31: patched

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/p5sagit/Web-Simple/commit/01e575827fdd9ba3a08063fd414b1de465380015.patch](https://github.com/p5sagit/Web-Simple/commit/01e575827fdd9ba3a08063fd414b1de465380015.patch)