Cross-site scripting in HTML::FormHandler Perl library via unescaped error messages
AI analysis
HTML::FormHandler, a Perl form-processing library, is vulnerable to cross-site scripting because its default error wrappers and renderers interpolate validation error strings directly into HTML without escaping. When a field declared with a check regexp, check list, or type constraint fails validation, the library's no_match and not_allowed messages and type-constraint failure messages splice the attacker-submitted value into the error, which _apply_actions passes to add_error and emits unescaped inside the error span. An attacker who submits markup to such a field gets it echoed back and gains script execution in the application's origin, with a stored variant possible if rejected values are re-rendered later. Only applications running HTML::FormHandler versions before 0.410000 that render errors through the library's own rendering roles are affected; applications that pass errors through their own escaping template layer are not. No public proof-of-concept or known in-the-wild exploitation has been reported, EPSS currently rates the 30-day exploitation probability at 0.2% (13th percentile), and the flaw is not in CISA KEV.
What to do: Upgrade to HTML::FormHandler 0.410000 or later. Audit applications for fields using check regexps, check lists, or type constraints whose errors are rendered through the library's rendering roles; rendering errors through an application-side escaping template layer is an effective interim mitigation.
Affected
| HTML::FormHandler (CPAN/Perl) HTML::FormHandler | all versions before 0.410000 |
Estimated exposure
nichelikely hundreds to low thousands of custom Perl web applications; exact installed base not publicly tracked — HTML::FormHandler is a niche CPAN form-validation library used in hand-built Perl web applications with no publicly tracked install counts, and only deployments using its default renderers with check- or type-constraint fields are actually…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages, no_match and not_allowed, splice the submitted value into that string, and a failing type constraint puts the rejected value into the message it builds, which _apply_actions hands to add_error. A field declared with a check regexp, a check list or a type constraint reaches those messages, with no custom validator and no non-default configuration. Errors rendered through an application's own escaping template layer rather than the library's rendering roles are not affected. A request over the network that submits markup to such a field gets it back live inside the error span, running script in the victim's origin. Re-rendering a rejected value later gives the stored variant.