Four XSS/HTML-injection vulnerabilities disclosed in Perl HTML::FormHandler; fixed in versions 0.410000 and 0.410002

Robert Rothenberg disclosed four cross-site scripting/HTML-injection flaws in the Perl HTML::FormHandler distribution on the oss-security mailing list on 2026-09-08 (CVE-2026-19872, CVE-2026-85484, CVE-2026-85485, CVE-2026-85630). Upgrading to version…

On 2026-09-08, Robert Rothenberg disclosed four vulnerabilities in the Perl HTML::FormHandler form-handling distribution (distributed via MetaCPAN) in separate posts to the oss-security mailing list. CVE-2026-19872 affects versions before 0.410000, where a user-submitted value is rendered unescaped within an error message, allowing cross-site scripting; it was fixed in version 0.410000. CVE-2026-85484 affects versions before 0.410002, where option group labels and radio button labels are rendered into HTML without escaping, potentially injecting attacker-controlled HTML into forms; it was fixed in 0.410002. CVE-2026-85485 also affects versions before 0.410002, where some error messages are rendered into HTML without escaping, potentially injecting attacker-controlled HTML or script into form output; it was fixed in 0.410002. CVE-2026-85630 affects versions before 0.410002 as well: the process_attrs method renders field attributes into HTML without escaping, allowing unescaped markup to be injected into generated HTML; it was fixed in 0.410002. Because CVE-2026-19872 affects only versions before 0.410000 and the other three affect versions before 0.410002, upgrading to 0.410002 or later satisfies all four fixed-version thresholds. The reports do not state any exploitation in the wild and provide no CVSS scores or affected-user counts.