CVE-2026-85485: HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping

HTML::FormHandler versions before 0.410002 for Perl insert validation error messages into rendered pages without HTML-escaping, a cross-site scripting flaw (CWE-79). The defect sits in the Table form layout and the Bootstrap 2 and Bootstrap 3 wrappers, which splice each error string directly into the surrounding markup; the 0.410000 release escaped the equivalent values in other layouts and wrappers as the fix for CVE-2026-19872, and 0.410002 extends that escaping to these three remaining paths. An attacker triggers the flaw by submitting a field value that fails validation and carries HTML or JavaScript, so the resulting error message echoes the payload unescaped into the page and it executes in the browser of anyone viewing that rendered form, potentially allowing session theft or actions in the user's context. Affected users are operators of web applications built with HTML::FormHandler whose forms use the Table layout or the Bootstrap 2/3 wrappers and whose error messages can include attacker-influenced content such as rejected field values. No public proof-of-concept is known, the issue is not in CISA KEV, CVSS has not yet been scored, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

Do: Upgrade HTML::FormHandler to 0.410002 or later, which escapes error messages in the Table layout and the Bootstrap 2 and 3 wrappers. Audit deployed applications for forms that use these three layouts/wrappers and check whether validation error messages can include attacker-supplied field values; until upgrading, prevent such values from reaching error output or escape them at the application layer.