# CVE-2026-120643: Perl CGI cross-site scripting in url and self_url

Source: https://junglewise.ai/threats/cve-2026-120643-cgi-versions-from-4-62-before-5-00-for-perl-allow-cross-site  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-120643 · Severity: info · Published 2026-11-04

The Perl CGI module provides functions that web applications use to construct URLs programmatically. Versions 4.62 through 4.99 fail to properly escape single quotes in URLs, allowing an attacker to break out of single-quoted HTML attributes or JavaScript strings by crafting a malicious URL. This enables cross-site scripting (XSS) attacks that could steal session cookies, redirect users, or execute malicious scripts in the victim's browser.

Technologies: [Perl CGI](https://junglewise.ai/threats/technologies/perl-cgi). Vendors: [Perl](https://junglewise.ai/threats/vendors/perl).

## Quick answers

**Is CVE-2026-120643 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120643 being exploited in the wild.

**How severe is CVE-2026-120643?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** Perl CGI 4.62 before 5.00.

**Is there a fix for CVE-2026-120643?** Yes: fixed in 5.00. Until then: Ensure that any URL returned by url() or self_url() is properly HTML-escaped before being placed in HTML attributes or JavaScript strings, even if single quotes are percent-encoded.</anigation>
</invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120643 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-120643?** Check whether you run Perl CGI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.00

Ensure that any URL returned by url() or self_url() is properly HTML-escaped before being placed in HTML attributes or JavaScript strings, even if single quotes are percent-encoded.</anigation>
</invoke>

## Technical details

The url() and self_url() functions pass URLs through URI::canonical(), which decodes percent-encoded unreserved characters including %27 (single quote) back to raw apostrophes. An apostrophe in the request path or query parameters remains unescaped in the output, allowing an attacker to inject a raw quote character. If an application embeds the returned URL in a single-quoted HTML attribute or JavaScript string without additional escaping, the attacker can break out and inject arbitrary code. The fix percent-encodes single quotes after canonicalization to prevent this breakout.

## Affected products

- Perl CGI 4.62 before 5.00

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/leejo/CGI.pm/commit/851430be84c4d0f350681814e1d7718b9959f2c2.patch](https://github.com/leejo/CGI.pm/commit/851430be84c4d0f350681814e1d7718b9959f2c2.patch)

## Related threats

- [Perl CGI infinite loop in read_postdata_putdata with disabled uploads](https://junglewise.ai/threats/cve-2026-120651-cgi-versions-before-5-00-for-perl-allow-an-infinite-loop-on-a)
- [CGI for Perl resource exhaustion via missing upload limits](https://junglewise.ai/threats/cve-2026-120650-cgi-versions-before-5-00-for-perl-allow-memory-cpu-and-disk)
- [Perl CGI HTML injection via comment delimiter](https://junglewise.ai/threats/cve-2026-120648-cgi-versions-before-5-00-for-perl-allow-html-injection-via-text)
- [Perl CGI header attachment parameter injection](https://junglewise.ai/threats/cve-2026-120647-cgi-versions-before-5-00-for-perl-allow-content-disposition)
- [Perl CGI taint bypass via request-derived values](https://junglewise.ai/threats/cve-2026-120642-cgi-versions-before-5-00-for-perl-return-request-derived-values)