The vulnerability arises when Web::Simple generates HTML from double‑quoted template strings that contain user-controlled interpolations. The library passes StringThing objects through the escaping routine, but when those objects are joined within a double‑quoted string the interpolated values are not entity escaped. An attacker who can inject a value into such a string can embed arbitrary JavaScript, causing cross‑site scripting on any user who views the page. The flaw corrupts input sanitization and leaves the application susceptible to client‑side code execution.

Perl Web::Simple modules released by the ETHER project that use the Web::Simple package before version 0.036 are affected. All releases from the project’s initial launch up to, but excluding, 0.036 contain the flaw. The updated package, starting with 0.036, implements proper escaping for interpolated values in double‑quoted strings.

Because the flaw manifests only when an application forwards attacker-controlled input into a double‑quoted string, the attack surface depends on template usage. No EPSS score is available and the vulnerability is not on the CISA KEV list, suggesting limited exploitation in the wild. However, the potential impact of unescaped JavaScript is significant: an attacker could hijack user sessions, steal credentials, or deliver phishing content. The CVSS base score would likely be in the medium to high range for an application exposed to the public internet. The absence of a current exploit in known deployments does not eliminate the risk; the flaw remains patent and exploitable.