Cross-site scripting (XSS) via unescaped attributes in HTML::FormHandler for Perl
AI analysis
HTML::FormHandler, a Perl CPAN form-processing library, renders field attributes into HTML through its process_attrs method without escaping them, which permits markup injection into attribute values (CWE-79). The flaw is triggered whenever an application builds field or field-label attributes from data rather than literals, allowing attacker-influenced text to override field attributes or embed JavaScript in the rendered page; the RadioGroup widget is one known path, via its render_option and wrap_radio methods. An attacker who can influence those attribute values can perform cross-site scripting (XSS) against users viewing the affected forms. Any application built on HTML::FormHandler versions before 0.410002 that uses data-driven attributes is affected, while deployments using only literal attributes and upgraded installations are not exposed through this path. Exploitation has not been observed: there is no public proof-of-concept, the issue is not listed in CISA KEV, and EPSS assigns a low 0.2% probability of exploitation within 30 days.
What to do: Upgrade to HTML::FormHandler 0.410002 or later. Until the upgrade is applied, review any forms whose field or label attributes are constructed from non-literal data (the RadioGroup widget via render_option/wrap_radio is a known path) and escape or strictly constrain those values before they reach process_attrs.
Affected
| HTML::FormHandler Project (CPAN) HTML::FormHandler (Perl CPAN module) | all versions before 0.410002 (fixed in 0.410002) |
Estimated exposure
nichelikely hundreds to low thousands of application deployments at most (estimate; no public install counts) — No public active-install counts exist for CPAN modules, but HTML::FormHandler is a specialized Perl web form library whose realistic deployment base (legacy Perl web applications, e.g., Catalyst-era apps) is small relative to the overall…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method. Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value that can override the field attributes or embed JavaScript in rendered pages. For example, the RadioGroup widget uses the process_attrs method via the render_option and wrap_radio methods.