{"id":"CVE-2026-125729","published":"2026-11-10T18:17:35.360","lastModified":"2026-11-10T20:19:09.787","description":"Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it.\n\nThe call method sets the policy in a response header named \"content-security-protocol\" instead of \"Content-Security-Policy\". Browsers ignore that header.\n\nAny cross-site scripting flaw in the wrapped application can run scripts the policy was meant to block.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-684"],"vendors":[],"products":[],"references":[{"url":"https://github.com/pangyre/Plack-Middleware-CSP/issues/1","tags":[]},{"url":"https://metacpan.org/release/ASHLEY/Plack-Middleware-CSP-0.03/source/CHANGES","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/10/16","tags":[]}],"exploitRefs":[{"url":"https://github.com/pangyre/Plack-Middleware-CSP/issues/1","tags":[]}],"hasPoc":true,"ai":null}