CVE-2026-120642

    Dashboard / Vulnerabilities / CVE-2026-120642

    CVE-2026-120642

    Published: 3 Nov 2026Last Modified: 7 Nov 2026

    Summary: CGI versions before 5.00 for Perl return request-derived values untainted under taint mode

    Details: CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadInfo values, some path_info and script_name values, Accept results, and the name lists from url_param and cookie are returned without the taint flag, as is a cookie named expires from 4.67 on. These values come from regex captures or hash keys, which Perl does not taint, so they pass -T checks unvalidated.

    References: https://cpan.org/modules, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120642.json, https://metacpan.org/release/LEEJO/CGI-5.00/changes, https://nvd.nist.gov/vuln/detail/CVE-2026-120642, https://github.com/leejo/CGI.pm/commit/6ae50ce84073b8f68a6e3750479de70d5b8f2dcf.patch, https://github.com/leejo/CGI.pm, https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -6ae50ce84073b8f68a6e3750479de70d5b8f2dcf

    Affected versions

    v4.72

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-120642 | CVE-DB