Is CVE-2026-120636 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120636 being exploited in the wild.

How severe is CVE-2026-120636?

Informational severity, published 4 November 2026.

How is CVE-2026-120636 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-120636?

Check whether you run Perl CGI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120636: Perl CGI open redirect and script injection via REQUEST_URI

CVE-2026-120636 · Severity: info · Published 2026-11-04

Perl's CGI module, a commonly used library for handling web requests, fails to validate client-supplied URLs in functions that build redirect links and form actions. An attacker can craft malicious requests that cause the application to redirect users to attacker-controlled sites or inject JavaScript code, leading to credential theft, session hijacking, or malware distribution.

Technologies: Perl CGI. Vendors: Perl.

Quick answers

Is CVE-2026-120636 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120636 being exploited in the wild.
How severe is CVE-2026-120636?: Informational severity, published 4 November 2026.
Which products and versions are affected?: Perl CGI before 5.00.
Is there a fix for CVE-2026-120636?: Yes: fixed in CGI 5.00. Until then: Reduce REQUEST_URI to a path on the host before use: strip any scheme and authority, collapse leading slashes and backslashes to a single slash, and prefix relative URLs that look like they have a scheme with ./. Do not return protocol-relative URLs from url() or start_form().</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-04"}, {"kind": "patched", "at": "2026-11-02", "note": "fix committed to repository"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120636 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-120636?: Check whether you run Perl CGI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: CGI 5.00

Reduce REQUEST_URI to a path on the host before use: strip any scheme and authority, collapse leading slashes and backslashes to a single slash, and prefix relative URLs that look like they have a scheme with ./. Do not return protocol-relative URLs from url() or start_form().</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-04"}, {"kind": "patched", "at": "2026-11-02", "note": "fix committed to repository"}]

Technical details

The vulnerability exists in CGI's url() and start_form() functions, which construct URLs from the REQUEST_URI environment variable without sanitizing client-controlled input. A request with REQUEST_URI containing protocol-relative URLs (//evil.example), absolute-form targets (http://evil.example/), backslashes, or javascript: schemes causes these functions to return URLs that redirect to another host or execute JavaScript. An attacker can exploit this by inducing users to follow crafted links or form submissions.

Affected products

Perl CGI before 5.00

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.