The vulnerability in HTML::Gumbo prior to version 0.19 arises from improper handling of the <template> element introduced in libgumbo 0.10.0. The walk_tree function in lib/HTML/Gumbo.xs does not support this element correctly and treats it as a text node. This causes strlen() to over-read beyond the intended memory boundary, disclosing heap contents. When parse() is called with format => 'string' or 'tree' on input containing a <template> element, the over-read bytes are serialized into the output, leading to information disclosure. The format => 'callback' mode triggers a croak error on the unhandled node type and is not vulnerable. There is no CVSS score or vendor advisory indicating a fix or mitigation.

This vulnerability allows an attacker to cause bounded heap memory disclosure when parsing HTML input containing <template> elements using vulnerable versions of HTML::Gumbo. The disclosed memory may contain sensitive information from the heap, leading to potential information leakage. There is no indication of remote code execution or denial of service. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid parsing untrusted HTML input containing <template> elements with format => 'string' or 'tree'. Using format => 'callback' avoids the vulnerability as it triggers an error on the unhandled node type. Monitor official BPS advisories or CPAN security announcements for updates and patches.