CGI::Cookie versions before 5.00 for Perl contain a vulnerability where cookie attribute injection is possible via unvalidated path, domain, and expires values. These values are inserted into the Set-Cookie header without validation for semicolons or control characters, allowing an attacker controlling these inputs to inject additional cookie attributes such as Domain or SameSite.