{"id":"CVE-2026-120644","published":"2026-11-04T00:17:25.897","lastModified":"2026-11-04T00:17:25.897","description":"CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values.\n\nThe path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters.\n\nAn application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-116"],"vendors":[],"products":[],"references":[{"url":"https://github.com/leejo/CGI.pm/commit/0b3527faaa9de55f79ca7d59dd3bcfb2c5540e00.patch","tags":[]},{"url":"https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI/Cookie.pm","tags":[]},{"url":"https://metacpan.org/release/LEEJO/CGI-5.00/changes","tags":[]}],"exploitRefs":[{"url":"https://github.com/leejo/CGI.pm/commit/0b3527faaa9de55f79ca7d59dd3bcfb2c5540e00.patch","tags":[]}],"hasPoc":true,"ai":null}