# CVE-2026-120212: Web::Simple HTML::Tags single-quoted attribute XSS

Source: https://junglewise.ai/threats/cve-2026-120212-web-simple-versions-before-0-037-for-perl-do-not-escape-single  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-120212 · Severity: info · Published 2026-11-10

Web::Simple is a Perl framework for building web applications. Its HTML::Tags module fails to escape single quotes in attribute values, allowing an attacker to break out of single-quoted HTML attributes and inject malicious scripts into web pages. This could lead to session hijacking, credential theft, or malware distribution to users of affected applications.

Technologies: [Perl Web::Simple](https://junglewise.ai/threats/technologies/web-simple). Vendors: [Perl](https://junglewise.ai/threats/vendors/perl).

## Quick answers

**Is CVE-2026-120212 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120212 being exploited in the wild.

**How severe is CVE-2026-120212?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** Perl Web::Simple before 0.037.

**Is there a fix for CVE-2026-120212?** Yes: fixed in 0.037. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120212 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-120212?** Check whether you run Perl Web::Simple at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.037

## Technical details

The HTML::Tags and XML::Tags modules in Web::Simple only escape &, ", <, and > characters in string values, omitting single quotes. When a user-controlled value is interpolated into a single-quoted attribute (e.g. href='$value'), an attacker can close the attribute with a quote and inject new attributes including event handlers. Double-quoted attributes are unaffected because double quotes are escaped.

## Affected products

- Perl Web::Simple before 0.037

## Timeline

- 2026-11-10: disclosed

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/p5sagit/Web-Simple/commit/de0b7743f7015ec2c1c678dfdaa4bc6f5ccfb640.patch](https://github.com/p5sagit/Web-Simple/commit/de0b7743f7015ec2c1c678dfdaa4bc6f5ccfb640.patch)

## Related threats

- [Web::Simple buffer allocation by Content-Length header](https://junglewise.ai/threats/cve-2026-114629-web-simple-versions-before-0-035-for-perl-allocate-a-buffer)