/ 
CGI-Simple-1.282
River stage three • 25 direct dependents • 813 total dependents
/ CGI::Simple::Util
Security Advisories (1)
CVE-2025-40927 (2025-08-29)

CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions. Although some validation exists, it can be bypassed using URL-encoded values, allowing an attacker to inject untrusted content into the response via query parameters. As a result, an attacker can inject a line break (e.g. %0A) into the parameter value, causing the server to split the HTTP response and inject arbitrary headers or even an HTML/JavaScript body, leading to reflected cross-site scripting (XSS), open redirect or other attacks. The issue documented in CVE-2010-4410 https://www.cve.org/CVERecord?id=CVE-2010-4410 is related but the fix was incomplete. Impact By injecting %0A (newline) into a query string parameter, an attacker can: * Break the current HTTP header * Inject a new header or entire body * Deliver a script payload that is reflected in the server’s response That can lead to the following attacks: * reflected XSS * open redirect * cache poisoning * header manipulation

NAME

CGI::Simple::Util - Internal utilities used by CGI::Simple module

SYNOPSIS

$escaped     = escapeHTML('In HTML you need to escape < > " and & chars');
$unescaped   = unescapeHTML('&lt;&gt;&quot;&amp;');
$url_encoded = escape($string);
$decoded     = unescape($url_encoded);

DESCRIPTION

CGI::Simple::Util contains essentially non public subroutines used by CGI::Simple. There are HTML and URL escape and unescape routines that may be of some use.

An internal object is used to store a number of system specific details to enable the escape routines to be accurate.

AUTHOR INFORMATION

Original version copyright 1995-1998, Lincoln D. Stein. All rights reserved. Originally copyright 2001 Dr James Freeman <jfreeman@tassie.net.au> This release by Andy Armstrong <andy@hexten.net>

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

Address bug reports and comments to: andy@hexten.net

SEE ALSO

CGI::Simple