CVE-2026-19872: HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message

HTML::FormHandler, a Perl form-processing library, is vulnerable to cross-site scripting because its default error wrappers and renderers interpolate validation error strings directly into HTML without escaping. When a field declared with a check regexp, check list, or type constraint fails validation, the library's no_match and not_allowed messages and type-constraint failure messages splice the attacker-submitted value into the error, which _apply_actions passes to add_error and emits unescaped inside the error span. An attacker who submits markup to such a field gets it echoed back and gains script execution in the application's origin, with a stored variant possible if rejected values are re-rendered later. Only applications running HTML::FormHandler versions before 0.410000 that render errors through the library's own rendering roles are affected; applications that pass errors through their own escaping template layer are not. No public proof-of-concept or known in-the-wild exploitation has been reported, EPSS currently rates the 30-day exploitation probability at 0.2% (13th percentile), and the flaw is not in CISA KEV.

Do: Upgrade to HTML::FormHandler 0.410000 or later. Audit applications for fields using check regexps, check lists, or type constraints whose errors are rendered through the library's rendering roles; rendering errors through an application-side escaping template layer is an effective interim mitigation.