AI analysis
CVE-2026-85484 is a cross-site scripting flaw (CWE-79) in the Perl module HTML::FormHandler, which in versions before 0.410002 renders option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets all render their group label unescaped — Select places it inside a label attribute while the other three place it in element content — and RadioGroup additionally renders each radio button's own label unescaped. The flaw is only triggered in applications whose option lists are built from data rather than literals (via options_from, an options_fieldname method, or the DBIC model); attacker-influenced text in those labels can inject markup, override the rendered options, or embed JavaScript that executes in users' browsers. Affected parties are operators of Perl applications built on HTML::FormHandler with dynamic option sources; because the module is a niche CPAN distribution, the exposed population is small. There is no public proof of concept and no CISA KEV listing, CVSS has not yet been scored, and EPSS estimates only a 0.2% probability of exploitation within 30 days.
What to do: Upgrade HTML::FormHandler to 0.410002 or later. Until patched, audit fields whose option lists are built with options_from, an options_fieldname method, or the DBIC model, and ensure any user-influenced label text is escaped or restricted to trusted literals. CVSS scoring is still pending, so re-check advisories for updates.
Affected
| HTML::FormHandler project (CPAN) HTML::FormHandler | all versions before 0.410002 |
Estimated exposure
nichelikely hundreds to low thousands of Perl applications (CPAN publishes no install counts) — CPAN has no authoritative install telemetry; HTML::FormHandler is a niche, mature Perl form framework whose exposure is further narrowed to applications using dynamic option sources (options_from, options_fieldname, or the DBIC model),…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, Select into a label attribute and the other three into element content. RadioGroup also renders each radio button's own label unescaped. Any application whose option list is built from data rather than literals, using options_from, an options_fieldname method, or the DBIC model, allows attacker-influenced text in a label that can override the options or embed JavaScript in rendered pages.