The escape_dangerous_chars function in CGI::Lite 2.0 and earlier does not correctly remove special characters including (1) "\"…

Description

The escape_dangerous_chars function in CGI::Lite 2.0 and earlier does not correctly remove special characters including (1) "\" (backslash), (2) "?", (3) "~" (tilde), (4) "^" (carat), (5) newline, or (6) carriage return, which could allow remote attackers to read or write arbitrary files, or execute arbitrary commands, in shell scripts that rely on CGI::Lite to filter such dangerous inputs.

Scores

EPSS (exploitation in 30 days)

1.9% · top 20% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.0.

Weakness

• n/a
• CWE-20 (opens in a new tab)

Affected products

• n/a

  • affected n/a

References (7)

• http://use.perl.org/~cbrooks/journal/10542 (opens in a new tab)x_refsource_MISCx_transferred
• 20030211 Security bug in CGI::Lite::escape_dangerous_chars() function (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 6833 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• 3237 (opens in a new tab)third-party-advisoryx_refsource_SREASONx_transferred
• cgilite-shell-command-execution(11308) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• http://search.cpan.org/~smylers/CGI-Lite-2.02/Lite.pm (opens in a new tab)x_refsource_CONFIRMx_transferred
• 20030211 Security bug in CGI::Lite::escape_dangerous_chars() function (opens in a new tab)mailing-listx_refsource_VULNWATCHx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Record last updated 8 Aug 2024, 02:28 UTC.