CVE-2026-85484: HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping
HTML::FormHandler before 0.410002 for Perl renders option group and radio button labels unescaped into HTML, enabling XSS (CVE-2026-85484).
Robert Rothenberg disclosed CVE-2026-85484 on the oss-security mailing list, affecting HTML::FormHandler versions before 0.410002 for Perl. The module renders option group labels and radio button labels into HTML without escaping, which can enable cross-site scripting in applications using the rendered markup. The issue is addressed in version 0.410002.
- Affected versions: all HTML::FormHandler releases before 0.410002 for Perl.
- Unescaped option group and radio button labels can inject attacker-controlled HTML into forms.
- Fixed in version 0.410002, distributed via MetaCPAN.
- CVEs
- CVE-2026-85484
- Products
- HTML::FormHandler
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85484 | Cross-site scripting via unescaped option labels in HTML::FormHandler (Perl) | 6.1 | <1% |
From the original article
Posted by Robert Rothenberg on Sep 08 ======================================================================== https://metacpan. org/dist/HTML-FormHandler VCS Repo: ...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.