ZeroHour
Product

HTML::FormHandler

0 mentions in 7 days · 4 in 30 days · 4 total · first seen · last

Timeline

CVE-2026-85630: HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method

CVE-2026-85630: HTML::FormHandler Perl versions before 0.410002 render field attributes into HTML unescaped, enabling HTML injection.

The Perl module HTML::FormHandler before version 0.410002 renders field attributes into HTML without escaping via the process_attrs method, per an oss-security disclosure. Applications using affected versions could allow unescaped markup to be injected into generated HTML. Users should upgrade to version 0.410002 or later.

CVE-2026-85485: HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping

HTML::FormHandler before 0.410002 for Perl renders error messages into HTML unescaped, enabling cross-site scripting (CVE-2026-85485); fixed in 0.410002.

Robert Rothenberg disclosed CVE-2026-85485 on the oss-security mailing list, affecting HTML::FormHandler versions before 0.410002 for Perl. The module renders some error messages into HTML without escaping, which can enable cross-site scripting in applications using its rendered output. The issue is fixed in version 0.410002.

CVE-2026-85484: HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping

HTML::FormHandler before 0.410002 for Perl renders option group and radio button labels unescaped into HTML, enabling XSS (CVE-2026-85484).

Robert Rothenberg disclosed CVE-2026-85484 on the oss-security mailing list, affecting HTML::FormHandler versions before 0.410002 for Perl. The module renders option group labels and radio button labels into HTML without escaping, which can enable cross-site scripting in applications using the rendered markup. The issue is addressed in version 0.410002.

CVE-2026-19872: HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message

Perl form library HTML::FormHandler before 0.410000 fixes CVE-2026-19872, a cross-site scripting flaw via unescaped submitted values in error messages.

CVE-2026-19872 was disclosed for the Perl HTML::FormHandler distribution: versions before 0.410000 render a submitted value unescaped within an error message, allowing cross-site scripting. The issue was announced by Robert Rothenberg on the oss-security mailing list. Applications using affected HTML::FormHandler versions should upgrade to 0.410000 or later.

Related CVEs

  • Cross-site scripting via unescaped error messages in HTML::FormHandler (Perl)
    HTML::FormHandler versions before 0.410002 for Perl insert validation error messages into rendered pages without HTML-escaping, a cross-site scripting flaw (CWE-79). The defect sits in the Table form layout and the Bootstrap 2 and Bootstrap 3 wrappers, which splice each error string directly into the surrounding markup; the 0.410000 release escaped the equivalent values in other layouts and wrappers as the fix for CVE-2026-19872, and 0.410002 extends that escaping to these three remaining paths. An attacker triggers the flaw by submitting a field value that fails validation and carries HTML or JavaScript, so the resulting error message echoes the payload unescaped into the page and it executes in the browser of anyone viewing that rendered form, potentially allowing session theft or actions in the user's context. Affected users are operators of web applications built with HTML::FormHandler whose forms use the Table layout or the Bootstrap 2/3 wrappers and whose error messages can include attacker-influenced content such as rejected field values. No public proof-of-concept is known, the issue is not in CISA KEV, CVSS has not yet been scored, and EPSS estimates only a 0.2% probability of exploitation within 30 days.
    · HTML::FormHandler project (Perl CPAN module) HTML::FormHandler all versions before 0.410002 (fixed in 0.410002); affected render paths: Table form layout, Bootstrap 2 wrapper, Bootstrap 3 wrapperniche
  • Cross-site scripting in HTML::FormHandler Perl library via unescaped error messages
    HTML::FormHandler, a Perl form-processing library, is vulnerable to cross-site scripting because its default error wrappers and renderers interpolate validation error strings directly into HTML without escaping. When a field declared with a check regexp, check list, or type constraint fails validation, the library's no_match and not_allowed messages and type-constraint failure messages splice the attacker-submitted value into the error, which _apply_actions passes to add_error and emits unescaped inside the error span. An attacker who submits markup to such a field gets it echoed back and gains script execution in the application's origin, with a stored variant possible if rejected values are re-rendered later. Only applications running HTML::FormHandler versions before 0.410000 that render errors through the library's own rendering roles are affected; applications that pass errors through their own escaping template layer are not. No public proof-of-concept or known in-the-wild exploitation has been reported, EPSS currently rates the 30-day exploitation probability at 0.2% (13th percentile), and the flaw is not in CISA KEV.
    · HTML::FormHandler (CPAN/Perl) HTML::FormHandler all versions before 0.410000niche
  • Cross-site scripting via unescaped option labels in HTML::FormHandler (Perl)
    CVE-2026-85484 is a cross-site scripting flaw (CWE-79) in the Perl module HTML::FormHandler, which in versions before 0.410002 renders option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets all render their group label unescaped — Select places it inside a label attribute while the other three place it in element content — and RadioGroup additionally renders each radio button's own label unescaped. The flaw is only triggered in applications whose option lists are built from data rather than literals (via options_from, an options_fieldname method, or the DBIC model); attacker-influenced text in those labels can inject markup, override the rendered options, or embed JavaScript that executes in users' browsers. Affected parties are operators of Perl applications built on HTML::FormHandler with dynamic option sources; because the module is a niche CPAN distribution, the exposed population is small. There is no public proof of concept and no CISA KEV listing, CVSS has not yet been scored, and EPSS estimates only a 0.2% probability of exploitation within 30 days.
    · HTML::FormHandler project (CPAN) HTML::FormHandler all versions before 0.410002niche
  • Cross-site scripting (XSS) via unescaped attributes in HTML::FormHandler for Perl
    HTML::FormHandler, a Perl CPAN form-processing library, renders field attributes into HTML through its process_attrs method without escaping them, which permits markup injection into attribute values (CWE-79). The flaw is triggered whenever an application builds field or field-label attributes from data rather than literals, allowing attacker-influenced text to override field attributes or embed JavaScript in the rendered page; the RadioGroup widget is one known path, via its render_option and wrap_radio methods. An attacker who can influence those attribute values can perform cross-site scripting (XSS) against users viewing the affected forms. Any application built on HTML::FormHandler versions before 0.410002 that uses data-driven attributes is affected, while deployments using only literal attributes and upgraded installations are not exposed through this path. Exploitation has not been observed: there is no public proof-of-concept, the issue is not listed in CISA KEV, and EPSS assigns a low 0.2% probability of exploitation within 30 days.
    · HTML::FormHandler Project (CPAN) HTML::FormHandler (Perl CPAN module) all versions before 0.410002 (fixed in 0.410002)niche
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.