CVE-2026-85484: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

HTML::FormHandler versions prior to 0.410002 for Perl contain an XSS vulnerability due to improper neutralization of input during web page generation (CWE-79). The Select widget renders group labels into label attributes without escaping, while RadioGroup, CheckboxGroup, and HorizCheckboxGroup render group labels and radio button labels as unescaped HTML content. Applications using dynamic data sources for option lists (e.g., options_from, options_fieldname, or DBIC model) can be exploited by attackers to inject malicious scripts into rendered pages.

An attacker can inject malicious JavaScript into web pages generated by vulnerable versions of HTML::FormHandler, potentially leading to cross-site scripting attacks. This can result in limited confidentiality and integrity impacts, such as stealing user session data or manipulating page content. The vulnerability does not impact availability. The CVSS score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impacts with scope changed.

A fix is available in HTML::FormHandler version 0.410002 and later. Users should upgrade to version 0.410002 or newer to remediate this vulnerability. Until upgrading, avoid using untrusted input to build option lists for the affected widgets or implement manual escaping of labels before rendering.