Cross-site scripting via unescaped error messages in HTML::FormHandler (Perl)
HTML::FormHandler versions before 0.410002 for Perl insert validation error messages into rendered pages without HTML-escaping, a cross-site scripting flaw (CWE-79). The defect sits in the Table form layout and the Bootstrap 2 and Bootstrap 3 wrappers, which splice each error string directly into the surrounding markup; the 0.410000 release escaped the equivalent values in other layouts and wrappers as the fix for CVE-2026-19872, and 0.410002 extends that escaping to these three remaining paths. An attacker triggers the flaw by submitting a field value that fails validation and carries HTML or JavaScript, so the resulting error message echoes the payload unescaped into the page and it executes in the browser of anyone viewing that rendered form, potentially allowing session theft or actions in the user's context. Affected users are operators of web applications built with HTML::FormHandler whose forms use the Table layout or the Bootstrap 2/3 wrappers and whose error messages can include attacker-influenced content such as rejected field values. No public proof-of-concept is known, the issue is not in CISA KEV, CVSS has not yet been scored, and EPSS estimates only a 0.2% probability of exploitation within 30 days.
· HTML::FormHandler project (Perl CPAN module) HTML::FormHandler all versions before 0.410002 (fixed in 0.410002); affected render paths: Table form layout, Bootstrap 2 wrapper, Bootstrap 3 wrapperniche
Cross-site scripting in HTML::FormHandler Perl library via unescaped error messages
HTML::FormHandler, a Perl form-processing library, is vulnerable to cross-site scripting because its default error wrappers and renderers interpolate validation error strings directly into HTML without escaping. When a field declared with a check regexp, check list, or type constraint fails validation, the library's no_match and not_allowed messages and type-constraint failure messages splice the attacker-submitted value into the error, which _apply_actions passes to add_error and emits unescaped inside the error span. An attacker who submits markup to such a field gets it echoed back and gains script execution in the application's origin, with a stored variant possible if rejected values are re-rendered later. Only applications running HTML::FormHandler versions before 0.410000 that render errors through the library's own rendering roles are affected; applications that pass errors through their own escaping template layer are not. No public proof-of-concept or known in-the-wild exploitation has been reported, EPSS currently rates the 30-day exploitation probability at 0.2% (13th percentile), and the flaw is not in CISA KEV.
· HTML::FormHandler (CPAN/Perl) HTML::FormHandler all versions before 0.410000niche
Cross-site scripting via unescaped option labels in HTML::FormHandler (Perl)
CVE-2026-85484 is a cross-site scripting flaw (CWE-79) in the Perl module HTML::FormHandler, which in versions before 0.410002 renders option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets all render their group label unescaped — Select places it inside a label attribute while the other three place it in element content — and RadioGroup additionally renders each radio button's own label unescaped. The flaw is only triggered in applications whose option lists are built from data rather than literals (via options_from, an options_fieldname method, or the DBIC model); attacker-influenced text in those labels can inject markup, override the rendered options, or embed JavaScript that executes in users' browsers. Affected parties are operators of Perl applications built on HTML::FormHandler with dynamic option sources; because the module is a niche CPAN distribution, the exposed population is small. There is no public proof of concept and no CISA KEV listing, CVSS has not yet been scored, and EPSS estimates only a 0.2% probability of exploitation within 30 days.
· HTML::FormHandler project (CPAN) HTML::FormHandler all versions before 0.410002niche
Cross-site scripting (XSS) via unescaped attributes in HTML::FormHandler for Perl
HTML::FormHandler, a Perl CPAN form-processing library, renders field attributes into HTML through its process_attrs method without escaping them, which permits markup injection into attribute values (CWE-79). The flaw is triggered whenever an application builds field or field-label attributes from data rather than literals, allowing attacker-influenced text to override field attributes or embed JavaScript in the rendered page; the RadioGroup widget is one known path, via its render_option and wrap_radio methods. An attacker who can influence those attribute values can perform cross-site scripting (XSS) against users viewing the affected forms. Any application built on HTML::FormHandler versions before 0.410002 that uses data-driven attributes is affected, while deployments using only literal attributes and upgraded installations are not exposed through this path. Exploitation has not been observed: there is no public proof-of-concept, the issue is not listed in CISA KEV, and EPSS assigns a low 0.2% probability of exploitation within 30 days.
· HTML::FormHandler Project (CPAN) HTML::FormHandler (Perl CPAN module) all versions before 0.410002 (fixed in 0.410002)niche