Four XSS/HTML-injection vulnerabilities disclosed in Perl HTML::FormHandler; fixed in versions 0.410000 and 0.410002

HTML::FormHandler, a Perl form-processing library, is vulnerable to cross-site scripting because its default error wrappers and renderers interpolate validation error strings directly into HTML without escaping. When a field declared with a check regexp, check list, or type constraint fails validation, the library's no_match and not_allowed messages and type-constraint failure messages splice the attacker-submitted value into the error, which _apply_actions passes to add_error and emits unescaped inside the error span. An attacker who submits markup to such a field gets it echoed back and gains script execution in the application's origin, with a stored variant possible if rejected values are re-rendered later. Only applications running HTML::FormHandler versions before 0.410000 that render errors through the library's own rendering roles are affected; applications that pass errors through their own escaping template layer are not. No public proof-of-concept or known in-the-wild exploitation has been reported, EPSS currently rates the 30-day exploitation probability at 0.2% (13th percentile), and the flaw is not in CISA KEV.

Do: Upgrade to HTML::FormHandler 0.410000 or later. Audit applications for fields using check regexps, check lists, or type constraints whose errors are rendered through the library's rendering roles; rendering errors through an application-side escaping template layer is an effective interim mitigation.

CVE-2026-85484 is a cross-site scripting flaw (CWE-79) in the Perl module HTML::FormHandler, which in versions before 0.410002 renders option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets all render their group label unescaped — Select places it inside a label attribute while the other three place it in element content — and RadioGroup additionally renders each radio button's own label unescaped. The flaw is only triggered in applications whose option lists are built from data rather than literals (via options_from, an options_fieldname method, or the DBIC model); attacker-influenced text in those labels can inject markup, override the rendered options, or embed JavaScript that executes in users' browsers. Affected parties are operators of Perl applications built on HTML::FormHandler with dynamic option sources; because the module is a niche CPAN distribution, the exposed population is small. There is no public proof of concept and no CISA KEV listing, CVSS has not yet been scored, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

Do: Upgrade HTML::FormHandler to 0.410002 or later. Until patched, audit fields whose option lists are built with options_from, an options_fieldname method, or the DBIC model, and ensure any user-influenced label text is escaped or restricted to trusted literals. CVSS scoring is still pending, so re-check advisories for updates.

HTML::FormHandler versions before 0.410002 for Perl insert validation error messages into rendered pages without HTML-escaping, a cross-site scripting flaw (CWE-79). The defect sits in the Table form layout and the Bootstrap 2 and Bootstrap 3 wrappers, which splice each error string directly into the surrounding markup; the 0.410000 release escaped the equivalent values in other layouts and wrappers as the fix for CVE-2026-19872, and 0.410002 extends that escaping to these three remaining paths. An attacker triggers the flaw by submitting a field value that fails validation and carries HTML or JavaScript, so the resulting error message echoes the payload unescaped into the page and it executes in the browser of anyone viewing that rendered form, potentially allowing session theft or actions in the user's context. Affected users are operators of web applications built with HTML::FormHandler whose forms use the Table layout or the Bootstrap 2/3 wrappers and whose error messages can include attacker-influenced content such as rejected field values. No public proof-of-concept is known, the issue is not in CISA KEV, CVSS has not yet been scored, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

Do: Upgrade HTML::FormHandler to 0.410002 or later, which escapes error messages in the Table layout and the Bootstrap 2 and 3 wrappers. Audit deployed applications for forms that use these three layouts/wrappers and check whether validation error messages can include attacker-supplied field values; until upgrading, prevent such values from reaching error output or escape them at the application layer.

HTML::FormHandler, a Perl CPAN form-processing library, renders field attributes into HTML through its process_attrs method without escaping them, which permits markup injection into attribute values (CWE-79). The flaw is triggered whenever an application builds field or field-label attributes from data rather than literals, allowing attacker-influenced text to override field attributes or embed JavaScript in the rendered page; the RadioGroup widget is one known path, via its render_option and wrap_radio methods. An attacker who can influence those attribute values can perform cross-site scripting (XSS) against users viewing the affected forms. Any application built on HTML::FormHandler versions before 0.410002 that uses data-driven attributes is affected, while deployments using only literal attributes and upgraded installations are not exposed through this path. Exploitation has not been observed: there is no public proof-of-concept, the issue is not listed in CISA KEV, and EPSS assigns a low 0.2% probability of exploitation within 30 days.

Do: Upgrade to HTML::FormHandler 0.410002 or later. Until the upgrade is applied, review any forms whose field or label attributes are constructed from non-literal data (the RadioGroup widget via render_option/wrap_radio is a known path) and escape or strictly constrain those values before they reach process_attrs.