CVE-2026-5090

Publication date 19 May 2026

Last updated 6 June 2026

Ubuntu priority

Cvss 3 Severity Score

Description

Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in <a id='ref' title='[% var | html %]'> would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example, var = " ' onclick='while (true) { alert(1) }'" Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libtemplate-perl	26.04 LTS resolute	Fixed 3.102-1ubuntu0.1
	25.10 questing	Fixed 2.27-1ubuntu0.25.10.1
	24.04 LTS noble	Fixed 2.27-1ubuntu0.24.04.1
	22.04 LTS jammy	Fixed 2.27-1ubuntu0.22.04.1
	20.04 LTS focal	Needs evaluation
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
libtemplate-perl	Upstream: 11c78a7

Severity score breakdown

Parameter	Value
Base score	6.1 · Medium
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Changed
Confidentiality	Low
Integrity impact	Low
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Related Ubuntu Security Notices (USN)

USN-8377-1
Template-Toolkit vulnerability
3 June 2026