# CVE-2026-120636: Perl CGI open redirect and script injection via REQUEST_URI

Source: https://junglewise.ai/threats/cve-2026-120636-cgi-versions-before-5-00-for-perl-allow-open-redirects-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-120636 · Severity: info · Published 2026-11-04

Perl's CGI module, a commonly used library for handling web requests, fails to validate client-supplied URLs in functions that build redirect links and form actions. An attacker can craft malicious requests that cause the application to redirect users to attacker-controlled sites or inject JavaScript code, leading to credential theft, session hijacking, or malware distribution.

Technologies: [Perl CGI](https://junglewise.ai/threats/technologies/perl-cgi). Vendors: [Perl](https://junglewise.ai/threats/vendors/perl).

## Quick answers

**Is CVE-2026-120636 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120636 being exploited in the wild.

**How severe is CVE-2026-120636?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** Perl CGI before 5.00.

**Is there a fix for CVE-2026-120636?** Yes: fixed in CGI 5.00. Until then: Reduce REQUEST_URI to a path on the host before use: strip any scheme and authority, collapse leading slashes and backslashes to a single slash, and prefix relative URLs that look like they have a scheme with ./. Do not return protocol-relative URLs from url() or start_form().</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-04"}, {"kind": "patched", "at": "2026-11-02", "note": "fix committed to repository"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120636 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-120636?** Check whether you run Perl CGI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in CGI 5.00

Reduce REQUEST_URI to a path on the host before use: strip any scheme and authority, collapse leading slashes and backslashes to a single slash, and prefix relative URLs that look like they have a scheme with ./. Do not return protocol-relative URLs from url() or start_form().</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-04"}, {"kind": "patched", "at": "2026-11-02", "note": "fix committed to repository"}]

## Technical details

The vulnerability exists in CGI's url() and start_form() functions, which construct URLs from the REQUEST_URI environment variable without sanitizing client-controlled input. A request with REQUEST_URI containing protocol-relative URLs (//evil.example), absolute-form targets (http://evil.example/), backslashes, or javascript: schemes causes these functions to return URLs that redirect to another host or execute JavaScript. An attacker can exploit this by inducing users to follow crafted links or form submissions.

## Affected products

- Perl CGI before 5.00

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/leejo/CGI.pm/commit/9405ef3909ee94991a3474167aa53b9051bd8765.patch](https://github.com/leejo/CGI.pm/commit/9405ef3909ee94991a3474167aa53b9051bd8765.patch)

## Related threats

- [Perl CGI infinite loop in read_postdata_putdata with disabled uploads](https://junglewise.ai/threats/cve-2026-120651-cgi-versions-before-5-00-for-perl-allow-an-infinite-loop-on-a)
- [CGI for Perl resource exhaustion via missing upload limits](https://junglewise.ai/threats/cve-2026-120650-cgi-versions-before-5-00-for-perl-allow-memory-cpu-and-disk)
- [Perl CGI HTML injection via comment delimiter](https://junglewise.ai/threats/cve-2026-120648-cgi-versions-before-5-00-for-perl-allow-html-injection-via-text)
- [Perl CGI header attachment parameter injection](https://junglewise.ai/threats/cve-2026-120647-cgi-versions-before-5-00-for-perl-allow-content-disposition)
- [Perl CGI cross-site scripting in url and self_url](https://junglewise.ai/threats/cve-2026-120643-cgi-versions-from-4-62-before-5-00-for-perl-allow-cross-site)