ZeroHour

CVE-2026-85630

niche

Cross-site scripting (XSS) via unescaped attributes in HTML::FormHandler for Perl

CVSS 3.1
6.1 medium
EPSS
<1%p10
Published
()
Modified
AI analysis

HTML::FormHandler, a Perl CPAN form-processing library, renders field attributes into HTML through its process_attrs method without escaping them, which permits markup injection into attribute values (CWE-79). The flaw is triggered whenever an application builds field or field-label attributes from data rather than literals, allowing attacker-influenced text to override field attributes or embed JavaScript in the rendered page; the RadioGroup widget is one known path, via its render_option and wrap_radio methods. An attacker who can influence those attribute values can perform cross-site scripting (XSS) against users viewing the affected forms. Any application built on HTML::FormHandler versions before 0.410002 that uses data-driven attributes is affected, while deployments using only literal attributes and upgraded installations are not exposed through this path. Exploitation has not been observed: there is no public proof-of-concept, the issue is not listed in CISA KEV, and EPSS assigns a low 0.2% probability of exploitation within 30 days.

What to do: Upgrade to HTML::FormHandler 0.410002 or later. Until the upgrade is applied, review any forms whose field or label attributes are constructed from non-literal data (the RadioGroup widget via render_option/wrap_radio is a known path) and escape or strictly constrain those values before they reach process_attrs.

Affected
HTML::FormHandler Project (CPAN) HTML::FormHandler (Perl CPAN module)all versions before 0.410002 (fixed in 0.410002)
Estimated exposure
nichelikely hundreds to low thousands of application deployments at most (estimate; no public install counts) — No public active-install counts exist for CPAN modules, but HTML::FormHandler is a specialized Perl web form library whose realistic deployment base (legacy Perl web applications, e.g., Catalyst-era apps) is small relative to the overall…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method. Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value that can override the field attributes or embed JavaScript in rendered pages. For example, the RadioGroup widget uses the process_attrs method via the render_option and wrap_radio methods.

Weakness
CWE-79
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In the news

CVE-2026-85630: HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method

CVE-2026-85630: HTML::FormHandler Perl versions before 0.410002 render field attributes into HTML unescaped, enabling HTML injection.

The Perl module HTML::FormHandler before version 0.410002 renders field attributes into HTML without escaping via the process_attrs method, per an oss-security disclosure. Applications using affected versions could allow unescaped markup to be injected into generated HTML. Users should upgrade to version 0.410002 or later.

oss-security · 7d agoVulnerabilityCVE-2026-856301