Form::Processor::Field::HtmlArea versions 0.06 through 1.162360 for Perl improperly neutralize special elements used in a template engine (Locale::Maketext). The validate method runs HTML::Tidy on submitted markup and passes diagnostic messages to add_error, which uses these messages as template keys. Because the default language handle compiles unknown messages as bracket notation templates, an attacker can inject bracket groups that invoke arbitrary methods on the language handle with attacker-chosen arguments. This can cause unhandled exceptions or resource exhaustion. Fields other than HtmlArea are unaffected as they pass fixed templates with submitted values as inert arguments.

An attacker can submit crafted markup to an HtmlArea field to trigger unhandled exceptions or cause arbitrary memory allocation, potentially leading to denial of service. Additionally, if the application’s language handle subclass defines public methods with side effects, these methods can be invoked with attacker-controlled arguments, potentially causing further unintended behavior. Confidentiality and integrity impacts are high due to the ability to execute arbitrary method dispatch. Availability impact is not directly indicated but resource exhaustion may cause service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, avoid using the vulnerable HtmlArea field or sanitize inputs to prevent injection of bracket notation templates in HTML::Tidy diagnostics. Monitor vendor channels for updates and apply official fixes once released.