CVE-2026-19872: HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message
Perl form library HTML::FormHandler before 0.410000 fixes CVE-2026-19872, a cross-site scripting flaw via unescaped submitted values in error messages.
CVE-2026-19872 was disclosed for the Perl HTML::FormHandler distribution: versions before 0.410000 render a submitted value unescaped within an error message, allowing cross-site scripting. The issue was announced by Robert Rothenberg on the oss-security mailing list. Applications using affected HTML::FormHandler versions should upgrade to 0.410000 or later.
- Attack vector is user-submitted values echoed unescaped in HTML::FormHandler error messages.
- All HTML::FormHandler releases before 0.410000 are affected.
- Disclosure was posted to the oss-security mailing list.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19872 | Cross-site scripting in HTML::FormHandler Perl library via unescaped error messages | 6.1 | <1% |
From the original article
Posted by Robert Rothenberg on Sep 08 ======================================================================== https://metacpan. org/dist/HTML-FormHandler VCS Repo: ...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.