Vulnerability details

CVE-2026-120642

CGI versions before 5.00 for Perl return request-derived values untainted under taint mode

CVSS 3.1

9.1Critical

Remedy

Remedy in the CVE record (record published by: CPANSec)

Upgrade to CGI 5.00 or later.

Official description

CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadInfo values, some path_info and script_name values, Accept results, and the name lists from url_param and cookie are returned without the taint flag, as is a cookie named expires from 4.67 on. These values come from regex captures or hash keys, which Perl does not taint, so they pass -T checks unvalidated.

CVSS scores

Score	Version	Source	Vector
9.1Critical	3.1	CISA ADP / Vulnrichment (CISA-ADP)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
No product information recorded.

References and advisories

https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm technical-description
https://metacpan.org/release/LEEJO/CGI-5.00/changes release-notes
https://github.com/leejo/CGI.pm/commit/6ae50ce84073b8f68a6e3750479de70d5b8f2dcf.patch patch

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-11-04
Last updated: 2026-11-09
State: Published
Assigner (CNA): CPANSec
Kolun priority: 23 · Low

Exploit prediction (EPSS)

0.42%

Probability of exploitation in 30 days

37.1%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-1173
Improper Use of Validation Framework