Template::Plugin::HTML versions through 3.102 for Perl contain an input neutralization flaw (CWE-79) in the html_filter function. This function fails to escape single quotes, enabling injection of limited HTML and JavaScript code into single-quoted HTML attributes. For example, an attacker can craft a variable value that injects an event handler attribute, leading to potential script execution. The vulnerability is constrained by the escaping of angle brackets, ampersands, and double quotes, limiting the scope of injection. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction needed, and partial impact on confidentiality and integrity.

An attacker can inject limited HTML and JavaScript code into web pages generated using the vulnerable Template::Plugin::HTML module, potentially leading to cross-site scripting (XSS) attacks. This could allow execution of arbitrary scripts in the context of the affected web application, impacting confidentiality and integrity of user data. However, the injection is limited due to escaping of certain characters, reducing the severity compared to full XSS vulnerabilities. No known exploits have been reported in the wild.

Patch status is not yet confirmed — no official fix or remediation guidance is currently available from the vendor. Users should monitor the vendor advisory for updates. Until a patch is released, avoid using untrusted input within single-quoted HTML attributes processed by the html_filter function or apply custom escaping to single quotes to mitigate injection risk.