CVE-2026-85630: HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method
CVE-2026-85630: HTML::FormHandler Perl versions before 0.410002 render field attributes into HTML unescaped, enabling HTML injection.
The Perl module HTML::FormHandler before version 0.410002 renders field attributes into HTML without escaping via the process_attrs method, per an oss-security disclosure. Applications using affected versions could allow unescaped markup to be injected into generated HTML. Users should upgrade to version 0.410002 or later.
25