/ 
Template-Toolkit-3.102
⭐ Starred 148 / Template::App::ttree
Security Advisories (1)
CVE-2026-5090 (2026-05-19)

Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in <a id='ref' title='[% var | html %]'> would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example, var = " ' onclick='while (true) { alert(1) }'" Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.

NAME

Template::App::ttree - Backend of ttree

SYNOPSIS

See Template::Tools::ttree.

DESCRIPTION

See Template::Tools::ttree.

AUTHORS

Andy Wardley <abw@wardley.org>

http://www.wardley.org

With contributions from Dylan William Hardison (support for dependencies), Bryce Harrington (absolute and relative options), Mark Anderson (suffix and debug options), Harald Joerg and Leon Brocard who gets everywhere, it seems.

COPYRIGHT

Copyright (C) 1996-2007 Andy Wardley. All Rights Reserved.

This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

SEE ALSO

Template::Tools::ttree