CGI versions from 4.62 up to but not including 5.00 for Perl contain a cross-site scripting (XSS) vulnerability. This occurs because URLs returned by the url and self_url methods pass through URI's canonical method, which leaves apostrophes in the path raw and decodes %27 in query parameters. If an application inserts these URLs into single-quoted HTML attributes or JavaScript strings, it may be vulnerable to XSS attacks.