Skip to content
OpenAdvisories
Medium USN-8377-1 1 CVE

libtemplate-perl vulnerability

Published Jun 3, 2026 · Updated Jun 3, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Template-Toolkit did not properly escape single
quotes in the html_filter function of Template::Plugin::HTML. An attacker
could possibly use this issue to inject arbitrary HTML and JavaScript into
generated output.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS libtemplate-perl 2.27-1ubuntu0.22.04.1
Ubuntu · 24.04 LTS 24.04:LTS libtemplate-perl 2.27-1ubuntu0.24.04.1
Ubuntu · 25.10 libtemplate-perl 2.27-1ubuntu0.25.10.1
Ubuntu · 26.04 LTS 26.04:LTS libtemplate-perl 3.102-1ubuntu0.1

Vulnerabilities 1

  • Medium 6.1
    CVE-2026-5090

    Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected

    Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in <a …

    libtemplate-perl libtemplate-perl Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2026-5090