HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the <template> element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses. Any caller that runs parse() with the default format => 'string', or with format => 'tree', on input containing a <template> element serializes the over-read bytes into the returned result, disclosing bounded heap contents. format => 'callback' reaches a croak on the unhandled node type and is unaffected.
The <template> element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to handle it. The element is incorrectly treated as a text node (type confusion, CWE-843), causing strlen() to be called on a pointer addressing a heap block intended for a different data type. This results in an out-of-bounds read (CWE-125). Any caller using parse() with the default format => 'string' or with format => 'tree' on input data containing a <template> element receives serialized bytes read out of bounds, thereby disclosing a limited portion of heap memory content. The format => 'callback' mode is not vulnerable because an unsupported node type causes a croak.
An attacker can obtain fragments of heap memory content from the process handling HTML data, which may lead to disclosure of sensitive information (e.g., keys, tokens, user data) stored in the application's memory.
HTML::Gumbo should be updated to version 0.19 or newer. A patch is available in the project's GitHub repository (commit 15c0598909d4a64f47ef0a1abc5051f4e113c186) and in the CPAN distribution under the designation HTML-Gumbo-0.19.
HTML::Gumbo for Perl in versions before 0.19
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H