Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitylow

CVE-2026-85630: HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method

oss-security ()2
Read at seclists.org
Part of a story covered by 2 sourcesTwo CVEs in HTML::FormHandler (Perl) before 0.410002: unescaped error messages and field attributes enable HTML injection/XSSMerged summary & timeline
AI summary · glm-5.3-flashSummaries by Vani AI

CVE-2026-85630: HTML::FormHandler Perl versions before 0.410002 render field attributes into HTML unescaped, enabling HTML injection.

The Perl module HTML::FormHandler before version 0.410002 renders field attributes into HTML without escaping via the process_attrs method, per an oss-security disclosure. Applications using affected versions could allow unescaped markup to be injected into generated HTML. Users should upgrade to version 0.410002 or later.

Key facts
  • Affects HTML::FormHandler versions before 0.410002
  • process_attrs renders field attributes without HTML escaping
  • Disclosed by Robert Rothenberg on oss-security
Analyze CVE-2026-85630 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-85630
Tags
cve-2026-85630html-formhandlerhtml-injectioninput-validationperl
Products
HTML::FormHandler

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-85630
Cross-site scripting (XSS) via unescaped attributes in HTML::FormHandler for Perl
6.1<1%

From the original article

Posted by Robert Rothenberg on Sep 08 ======================================================================== https://metacpan. org/dist/HTML-FormHandler VCS Repo: ...

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.