Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitylow

Two CVEs in HTML::FormHandler (Perl) before 0.410002: unescaped error messages and field attributes enable HTML injection/XSS

1 source · 2 articlesFirst reported Updated ()3
What's new

Initial merged summary: combined two oss-security disclosures (CVE-2026-85485 and CVE-2026-85630) from 2026-09-08 into a single story about HTML::FormHandler before 0.410002; both share the same affected version range, reporter, disclosure channel, and fix version 0.410002.

Merged summary · glm-5.3 · rewritten as coverage arrivesSummaries by Vani AI

HTML::FormHandler for Perl, in all versions before 0.410002, renders both error messages (CVE-2026-85485) and field attributes via process_attrs (CVE-2026-85630) into HTML without escaping, enabling cross-site scripting/HTML injection; both issues are fixed…

Robert Rothenberg disclosed two related vulnerabilities in the Perl module HTML::FormHandler on the oss-security mailing list on 2026-09-08, both affecting versions before 0.410002. CVE-2026-85485 concerns error messages being rendered into HTML without escaping, which can enable cross-site scripting in applications using the rendered form output. CVE-2026-85630 concerns field attributes being rendered unescaped via the process_attrs method, allowing unescaped markup to be injected into generated HTML. In both cases attacker-controlled content could be injected into form output. Both issues are fixed in version 0.410002, distributed via MetaCPAN, and users should upgrade to 0.410002 or later.

Key facts
  • Affected versions: all HTML::FormHandler releases before 0.410002 for Perl.
  • CVE-2026-85485: some error messages are rendered into HTML without escaping, enabling cross-site scripting.
  • CVE-2026-85630: field attributes rendered via the process_attrs method are not HTML-escaped, enabling HTML injection.
  • Both vulnerabilities were disclosed by Robert Rothenberg on the oss-security mailing list on 2026-09-08 (postings at 20:28:39Z and 20:30:22Z).
  • Both issues are fixed in HTML::FormHandler version 0.410002, distributed via MetaCPAN; users should upgrade to 0.410002 or later.
Analyze CVE-2026-85485 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-85485CVE-2026-85630
Products
HTML::FormHandler

Coverage

oldest first · one row per article · UTC
  1. · Sep 8, 2026 oss-securityFirst report

    CVE-2026-85485: HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping

    HTML::FormHandler before 0.410002 for Perl renders error messages into HTML unescaped, enabling cross-site scripting (CVE-2026-85485); fixed in 0.410002.

  2. · Sep 8, 2026 oss-security

    CVE-2026-85630: HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method

    CVE-2026-85630: HTML::FormHandler Perl versions before 0.410002 render field attributes into HTML unescaped, enabling HTML injection.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-85485
Cross-site scripting via unescaped error messages in HTML::FormHandler (Perl)
6.1<1%
CVE-2026-85630
Cross-site scripting (XSS) via unescaped attributes in HTML::FormHandler for Perl
6.1<1%