CVE-2024-55918: 
Linux Debian vulnerability analysis and mitigation

An issue was discovered in the Graphics::ColorNames package before 3.2.0 for Perl. There is an ambiguity between modules and filenames that can lead to HTML injection by an attacker who can create a file in the current working directory (NVD, MITRE).

The vulnerability stems from insufficient validation in how the package handles filenames and modules, creating an ambiguity that could be exploited. The issue was addressed in version 3.2.0 by requiring filenames to be absolute and fixing the ambiguity between modules and filenames (MetaCPAN Changes). The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) (NVD).

The vulnerability allows an attacker who can create a file in the current working directory to perform HTML injection attacks. This could potentially lead to unauthorized code execution or data manipulation within the context of the application using the Graphics::ColorNames package (NVD).

Users should upgrade to Graphics::ColorNames version 3.2.0 or later, which fixes the vulnerability by requiring filenames to be absolute and resolving the ambiguity between modules and filenames (MetaCPAN Changes).