Two CVEs in HTML::FormHandler (Perl) before 0.410002: unescaped error messages and field attributes enable HTML injection/XSS

HTML::FormHandler versions before 0.410002 for Perl insert validation error messages into rendered pages without HTML-escaping, a cross-site scripting flaw (CWE-79). The defect sits in the Table form layout and the Bootstrap 2 and Bootstrap 3 wrappers, which splice each error string directly into the surrounding markup; the 0.410000 release escaped the equivalent values in other layouts and wrappers as the fix for CVE-2026-19872, and 0.410002 extends that escaping to these three remaining paths. An attacker triggers the flaw by submitting a field value that fails validation and carries HTML or JavaScript, so the resulting error message echoes the payload unescaped into the page and it executes in the browser of anyone viewing that rendered form, potentially allowing session theft or actions in the user's context. Affected users are operators of web applications built with HTML::FormHandler whose forms use the Table layout or the Bootstrap 2/3 wrappers and whose error messages can include attacker-influenced content such as rejected field values. No public proof-of-concept is known, the issue is not in CISA KEV, CVSS has not yet been scored, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

Do: Upgrade HTML::FormHandler to 0.410002 or later, which escapes error messages in the Table layout and the Bootstrap 2 and 3 wrappers. Audit deployed applications for forms that use these three layouts/wrappers and check whether validation error messages can include attacker-supplied field values; until upgrading, prevent such values from reaching error output or escape them at the application layer.

HTML::FormHandler, a Perl CPAN form-processing library, renders field attributes into HTML through its process_attrs method without escaping them, which permits markup injection into attribute values (CWE-79). The flaw is triggered whenever an application builds field or field-label attributes from data rather than literals, allowing attacker-influenced text to override field attributes or embed JavaScript in the rendered page; the RadioGroup widget is one known path, via its render_option and wrap_radio methods. An attacker who can influence those attribute values can perform cross-site scripting (XSS) against users viewing the affected forms. Any application built on HTML::FormHandler versions before 0.410002 that uses data-driven attributes is affected, while deployments using only literal attributes and upgraded installations are not exposed through this path. Exploitation has not been observed: there is no public proof-of-concept, the issue is not listed in CISA KEV, and EPSS assigns a low 0.2% probability of exploitation within 30 days.

Do: Upgrade to HTML::FormHandler 0.410002 or later. Until the upgrade is applied, review any forms whose field or label attributes are constructed from non-literal data (the RadioGroup widget via render_option/wrap_radio is a known path) and escape or strictly constrain those values before they reach process_attrs.