Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in <a id='ref' title='[% var | html %]'> would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example, var = " ' onclick='while (true) { alert(1) }'" Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1797 advisory.

    emplate::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The     html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have     code injected. For example, the variable var in <a id='ref' title='[% var | html %]'> would not be     properly escaped. An attacker could insert some limited HTML and JavaScript, for example, var =  '     onclick='while (true) { alert(1) }' Note that arbitrary HTML and JavaScript would be difficult to inject,     because angle brackets, ampersands and double-quotes would still be escaped. (CVE-2026-5090)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of perl-Template-Toolkit installed on the remote host is prior to 2.24-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3345 advisory.

    emplate::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The     html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have     code injected. For example, the variable var in <a id='ref' title='[% var | html %]'> would not be     properly escaped. An attacker could insert some limited HTML and JavaScript, for example, var =  '     onclick='while (true) { alert(1) }' Note that arbitrary HTML and JavaScript would be difficult to inject,     because angle brackets, ampersands and double-quotes would still be escaped. (CVE-2026-5090)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8377-1 advisory.

    It was discovered that Template-Toolkit did not properly escape single quotes in the html_filter function     of Template::Plugin::HTML. An attacker could possibly use this issue to inject arbitrary HTML and     JavaScript into generated output.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The     html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have     code injected. For example, the variable var in <a id='ref' title='[% var | html %]'> would not be     properly escaped. An attacker could insert some limited HTML and JavaScript, for example, var =  '     onclick='while (true) { alert(1) }' Note that arbitrary HTML and JavaScript would be difficult to inject,     because angle brackets, ampersands and double-quotes would still be escaped. (CVE-2026-5090)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
319873	Amazon Linux 2023 : perl-Template-Toolkit (ALAS2023-2026-1797)	Nessus	Amazon Linux Local Security Checks	medium
319839	Amazon Linux 2 : perl-Template-Toolkit, --advisory ALAS2-2026-3345 (ALAS-2026-3345)	Nessus	Amazon Linux Local Security Checks	medium
318636	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Template-Toolkit vulnerability (USN-8377-1)	Nessus	Ubuntu Local Security Checks	medium
315594	Linux Distros Unpatched Vulnerability : CVE-2026-5090	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-5090

medium

Tenable Plugins

medium

medium

medium

medium