/ 
Template-Toolkit-3.102
⭐ Starred 148 / Template::Grammar
Security Advisories (1)
CVE-2026-5090 (2026-05-19)

Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in <a id='ref' title='[% var | html %]'> would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example, var = " ' onclick='while (true) { alert(1) }'" Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.

NAME

Template::Grammar - Parser state/rule tables for the TT grammar

SYNOPSIS

# no user serviceable parts inside

DESCRIPTION

This module defines the state and rule tables that the Template::Parser module uses to parse templates. It is generated from a YACC-like grammar using the Parse::Yapp module. The parser sub-directory of the Template Toolkit source distribution contains the grammar and other files required to generate this module.

But you don't need to worry about any of that unless you're planning to modify the Template Toolkit language.

AUTHOR

Andy Wardley <abw@wardley.org>

http://wardley.org/

COPYRIGHT

Copyright (C) 1996-2022 Andy Wardley. All Rights Reserved.

This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

SEE ALSO

Template::Parser