Template::Plugin::HTML for Perl before version 3.103 does not escape single quotes within the html_filter function. When template attribute values are enclosed in single quotes, attacker‑supplied data can be injected as additional attribute values containing HTML or JavaScript code. For example, assigning a variable to ' onclick='while(true){alert(1)}'' results in an injected onclick handler that will execute when the rendered page loads. Although angle brackets, ampersands and double‑quotes remain escaped, the single‑quote vulnerability allows a limited form of XSS that can deface content or steal credentials. This weakness is classified as CWE‑79, an input validation failure permitting client‑side script execution.

Any installation of Template::Plugin::HTML for Perl with a version of 3.102 or earlier. The vulnerability becomes relevant for applications that use this plugin to render user‑supplied data into web pages, including custom web frameworks or content management systems that integrate the plugin. No specific product family beyond the Perl module is listed, so any system employing the affected code is at risk.

The vulnerability can be exploited by any actor who can supply data that is passed through the html_filter into a template rendered with single‑quoted attributes. The required conditions are minimal: untrusted data reaching the template, use of single‑quoted attributes, and no additional sanitization of single quotes. Because the attack surface is the template rendering engine, an attacker with the ability to influence template input can create a cross‑site scripting flaw. The CVSS score is 6.1, the EPSS score is less than 1%, and the issue is not listed in CISA KEV, indicating limited publicly documented exploitation at this time. However, the nature of XSS makes it suitable for phishing or credential theft, so it should be considered a high risk for exposed web applications.