CVE-2026-85484: HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping
HTML::FormHandler before 0.410002 for Perl renders option group and radio button labels unescaped into HTML, enabling XSS (CVE-2026-85484).