The vulnerability arises because the CGI module constructs redirect URLs and form action attributes directly from the client‑supplied REQUEST_URI without performing any validation. Functions url(-absolute=>1), url(-relative=>1) and the default start_form action can generate protocol‑relative URLs (//evil.example), absolute URLs (http://evil.example/) or URLs that contain backslashes and even javascript: schemes. When these URLs are rendered in links or form actions, an attacker can cause the browser to navigate to a malicious host or execute arbitrary JavaScript in the context of the victim’s browser.

Affected products are all installations of Perl’s CGI.pm version earlier than 5.00. The module is maintained by LEEJO and the fix increments the version to 5.00 or later. Any web application that imports CGI.pm before this release and relies on the url() or start_form() functions for generating user‑visible links or form actions is potentially vulnerable.

Although no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the lack of input validation makes exploitation trivial via specially crafted URLs; no authentication is required. The CVSS score of 6.1 indicates moderate severity. An attacker can redirect users to phishing sites or inject client‑side scripts, undermining confidentiality and integrity of the user session.