CGI versions for Perl prior to 5.00 contain a vulnerability that allows HTML injection when text containing the sequence '-->' is included in comments. This occurs because arguments are placed between <!-- and --> without proper escaping, allowing an attacker to prematurely close the comment and inject HTML content into the page.