Executive brief
Template::Plugin::HTML is a Perl library used to format and clean up text for display on websites. A security flaw in this library fails to properly clean single quotes, which could allow a malicious actor to inject unauthorized scripts or content into a webpage. This could lead to actions being performed on behalf of a user or the display of misleading information, though the impact is limited because other common characters like brackets and double quotes are still correctly blocked.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in Template::Plugin::HTML through version 3.102. The 'html_filter' function and 'HTML.escape' method fail to escape single quotes ('), while correctly escaping double quotes, ampersands, and angle brackets. If a developer places a template variable inside a single-quoted HTML attribute (e.g., <div title='[% var | html %]'>), an attacker can provide input that breaks out of the attribute to inject limited HTML or JavaScript event handlers like 'onclick'. A fix was merged into the master branch in March 2026 to use the ''' numeric entity for escaping.
Affected products
- Template Toolkit (CPAN) Template::Plugin::HTML through 3.102
Timeline
- 2026-02-21: other: Fix committed to repository
- 2026-03-22: patched: Fix merged into master branch
- 2026-05-19: disclosed: CVE published