ZeroHour

CVE-2026-85484

niche1

Cross-site scripting via unescaped option labels in HTML::FormHandler (Perl)

CVSS 3.1
6.1 medium
EPSS
<1%p10
Published
()
Modified
AI analysis

CVE-2026-85484 is a cross-site scripting flaw (CWE-79) in the Perl module HTML::FormHandler, which in versions before 0.410002 renders option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets all render their group label unescaped — Select places it inside a label attribute while the other three place it in element content — and RadioGroup additionally renders each radio button's own label unescaped. The flaw is only triggered in applications whose option lists are built from data rather than literals (via options_from, an options_fieldname method, or the DBIC model); attacker-influenced text in those labels can inject markup, override the rendered options, or embed JavaScript that executes in users' browsers. Affected parties are operators of Perl applications built on HTML::FormHandler with dynamic option sources; because the module is a niche CPAN distribution, the exposed population is small. There is no public proof of concept and no CISA KEV listing, CVSS has not yet been scored, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

What to do: Upgrade HTML::FormHandler to 0.410002 or later. Until patched, audit fields whose option lists are built with options_from, an options_fieldname method, or the DBIC model, and ensure any user-influenced label text is escaped or restricted to trusted literals. CVSS scoring is still pending, so re-check advisories for updates.

Affected
HTML::FormHandler project (CPAN) HTML::FormHandlerall versions before 0.410002
Estimated exposure
nichelikely hundreds to low thousands of Perl applications (CPAN publishes no install counts) — CPAN has no authoritative install telemetry; HTML::FormHandler is a niche, mature Perl form framework whose exposure is further narrowed to applications using dynamic option sources (options_from, options_fieldname, or the DBIC model),…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, Select into a label attribute and the other three into element content. RadioGroup also renders each radio button's own label unescaped. Any application whose option list is built from data rather than literals, using options_from, an options_fieldname method, or the DBIC model, allows attacker-influenced text in a label that can override the options or embed JavaScript in rendered pages.

Weakness
CWE-79
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In the news

CVE-2026-85484: HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping

HTML::FormHandler before 0.410002 for Perl renders option group and radio button labels unescaped into HTML, enabling XSS (CVE-2026-85484).

Robert Rothenberg disclosed CVE-2026-85484 on the oss-security mailing list, affecting HTML::FormHandler versions before 0.410002 for Perl. The module renders option group labels and radio button labels into HTML without escaping, which can enable cross-site scripting in applications using the rendered markup. The issue is addressed in version 0.410002.

oss-security · 7d agoVulnerabilityCVE-2026-85484