ZeroHour

CVE-2026-19872

niche

Cross-site scripting in HTML::FormHandler Perl library via unescaped error messages

CVSS 3.1
6.1 medium
EPSS
<1%p13
Published
()
Modified
AI analysis

HTML::FormHandler, a Perl form-processing library, is vulnerable to cross-site scripting because its default error wrappers and renderers interpolate validation error strings directly into HTML without escaping. When a field declared with a check regexp, check list, or type constraint fails validation, the library's no_match and not_allowed messages and type-constraint failure messages splice the attacker-submitted value into the error, which _apply_actions passes to add_error and emits unescaped inside the error span. An attacker who submits markup to such a field gets it echoed back and gains script execution in the application's origin, with a stored variant possible if rejected values are re-rendered later. Only applications running HTML::FormHandler versions before 0.410000 that render errors through the library's own rendering roles are affected; applications that pass errors through their own escaping template layer are not. No public proof-of-concept or known in-the-wild exploitation has been reported, EPSS currently rates the 30-day exploitation probability at 0.2% (13th percentile), and the flaw is not in CISA KEV.

What to do: Upgrade to HTML::FormHandler 0.410000 or later. Audit applications for fields using check regexps, check lists, or type constraints whose errors are rendered through the library's rendering roles; rendering errors through an application-side escaping template layer is an effective interim mitigation.

Affected
HTML::FormHandler (CPAN/Perl) HTML::FormHandlerall versions before 0.410000
Estimated exposure
nichelikely hundreds to low thousands of custom Perl web applications; exact installed base not publicly tracked — HTML::FormHandler is a niche CPAN form-validation library used in hand-built Perl web applications with no publicly tracked install counts, and only deployments using its default renderers with check- or type-constraint fields are actually…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages, no_match and not_allowed, splice the submitted value into that string, and a failing type constraint puts the rejected value into the message it builds, which _apply_actions hands to add_error. A field declared with a check regexp, a check list or a type constraint reaches those messages, with no custom validator and no non-default configuration. Errors rendered through an application's own escaping template layer rather than the library's rendering roles are not affected. A request over the network that submits markup to such a field gets it back live inside the error span, running script in the victim's origin. Re-rendering a rejected value later gives the stored variant.

Weakness
CWE-79
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In the news

CVE-2026-19872: HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message

Perl form library HTML::FormHandler before 0.410000 fixes CVE-2026-19872, a cross-site scripting flaw via unescaped submitted values in error messages.

CVE-2026-19872 was disclosed for the Perl HTML::FormHandler distribution: versions before 0.410000 render a submitted value unescaped within an error message, allowing cross-site scripting. The issue was announced by Robert Rothenberg on the oss-security mailing list. Applications using affected HTML::FormHandler versions should upgrade to 0.410000 or later.

oss-security · 7d agoVulnerabilityCVE-2026-19872