CVE-2026-85484: HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping

CVE-2026-85484 is a cross-site scripting flaw (CWE-79) in the Perl module HTML::FormHandler, which in versions before 0.410002 renders option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets all render their group label unescaped — Select places it inside a label attribute while the other three place it in element content — and RadioGroup additionally renders each radio button's own label unescaped. The flaw is only triggered in applications whose option lists are built from data rather than literals (via options_from, an options_fieldname method, or the DBIC model); attacker-influenced text in those labels can inject markup, override the rendered options, or embed JavaScript that executes in users' browsers. Affected parties are operators of Perl applications built on HTML::FormHandler with dynamic option sources; because the module is a niche CPAN distribution, the exposed population is small. There is no public proof of concept and no CISA KEV listing, CVSS has not yet been scored, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

Do: Upgrade HTML::FormHandler to 0.410002 or later. Until patched, audit fields whose option lists are built with options_from, an options_fieldname method, or the DBIC model, and ensure any user-influenced label text is escaped or restricted to trusted literals. CVSS scoring is still pending, so re-check advisories for updates.