CVE-2026-5090 TODDR CVE debrief

Who should care

Teams maintaining or operating Perl applications that use Template::Plugin::HTML, especially where untrusted values are rendered into single-quoted HTML attributes. Web application security owners reviewing template escaping and output encoding should also treat this as a user-interaction-driven XSS risk.

Technical summary

The flaw is in attribute-context escaping: html_filter does not escape the single quote character. In a template pattern such as a single-quoted attribute containing a filtered variable, attacker-controlled input can terminate the attribute value and inject event-handler or similar limited script-bearing markup. Because other metacharacters remain escaped, exploitation is constrained, but the condition still fits cross-site scripting. The supplied NVD metadata classifies the issue as CWE-79 with a network-reachable, user-interaction-required attack profile.

Defensive priority

Medium. The issue is remotely reachable in web applications but requires a vulnerable template pattern and user interaction, so it is not an emergency for every Perl deployment. Prioritize systems that render untrusted content into single-quoted HTML attributes with this plugin.

Recommended defensive actions

• Inventory applications and templates that use Template::Plugin::HTML.
• Find any single-quoted HTML attributes that render untrusted values through the html filter.
• Review the upstream issue and pull request references for the coordinated fix and any release guidance.
• Upgrade to a corrected release or apply the upstream patch as soon as one is available.
• Re-test affected templates after remediation to confirm attribute-context escaping is correct.
• Prefer context-appropriate escaping and avoid assuming a general HTML filter is safe in all attribute contexts.

Evidence notes

The source description states that Template::Plugin::HTML through 3.102 for Perl allows HTML and JavaScript injection because html_filter did not escape single quotes. The NVD metadata for the same CVE lists vulnStatus as Deferred, assigns CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, and maps the weakness to CWE-79. The supplied references point to an upstream GitHub issue, a GitHub pull request changes page, and an oss-security thread. The corpus does not provide a fixed version number.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.