CVE-2026-19872: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The vulnerability in HTML::FormHandler (CVE-2026-19872) arises from improper neutralization of input during web page generation (CWE-79). The library's error rendering roles interpolate error messages containing user-submitted values directly into HTML without escaping. This includes messages such as no_match and not_allowed, which splice the submitted value into the error string. Fields with check regexp, check list, or type constraints that fail validation trigger these messages, resulting in reflected XSS. If the application relies on the library's default error rendering, the submitted malicious markup executes in the user's browser. Applications that use custom escaping templates are not vulnerable. The affected versions are all versions before 0.410000.

An attacker can submit malicious markup in form fields that fail validation, causing the markup to be reflected unescaped in error messages. This leads to cross-site scripting (XSS) attacks, allowing execution of arbitrary scripts in the context of the victim's browser. The vulnerability has a CVSS score of 6.1 (medium severity) with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts confidentiality and integrity. There is no indication of known exploits in the wild.

No official patch or fix is indicated in the provided data. Users should verify if a newer version beyond 0.410000 is available that addresses this issue. Alternatively, applications can mitigate the vulnerability by using their own escaping template layers for rendering error messages instead of relying on the library's default rendering roles. Until a patch is confirmed, avoid using vulnerable versions or implement custom escaping for error outputs.