CODECHILD HTML::Bare vulnerabilities

Latest CODECHILD HTML::Bare CVEs

Newest publication first

1. CVE-2026-57073 HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead

   Published 2026-07-16

   Critical·CVSS 9.1

   HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within the buffer. Truncated string...

2. CVE-2026-13397 HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes

   Published 2026-07-16

   High·CVSS 7.5

   HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc_parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever. Nameless attributes such as "<a ='c'>" or u...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.