CVE-2026-85485: HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping
HTML::FormHandler before 0.410002 for Perl renders error messages into HTML unescaped, enabling cross-site scripting (CVE-2026-85485); fixed in 0.410002.
Robert Rothenberg disclosed CVE-2026-85485 on the oss-security mailing list, affecting HTML::FormHandler versions before 0.410002 for Perl. The module renders some error messages into HTML without escaping, which can enable cross-site scripting in applications using its rendered output. The issue is fixed in version 0.410002.
- Affected versions: all HTML::FormHandler releases before 0.410002 for Perl.
- Unescaped error-message rendering can inject attacker-controlled HTML or script into form output.
- Fixed in version 0.410002, distributed via MetaCPAN.
- CVEs
- CVE-2026-85485
- Products
- HTML::FormHandler
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85485 | Cross-site scripting via unescaped error messages in HTML::FormHandler (Perl) | 6.1 | <1% |
From the original article
Posted by Robert Rothenberg on Sep 08 ======================================================================== https://metacpan. org/dist/HTML-FormHandler VCS Repo: ...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.