CVE-2026-85484: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-85484 is a cross-site scripting vulnerability in HTML::FormHandler versions prior to 0.410002. The issue occurs because the Select, RadioGroup, CheckboxGroup, and HorizCheckboxGroup widgets render group labels and radio button labels into HTML without proper escaping. Specifically, Select renders group labels into a label attribute unescaped, while the other widgets render them into element content unescaped. RadioGroup also renders each radio button's label unescaped. Applications that generate option lists from data sources such as options_from, options_fieldname methods, or DBIC models can be exploited by attackers to inject malicious JavaScript via these labels.

An attacker can inject malicious JavaScript into web pages generated by vulnerable applications, potentially leading to cross-site scripting attacks. This can result in partial confidentiality and integrity loss (e.g., theft of user data or session tokens) but does not affect availability. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and scope change.

A fix is available in HTML::FormHandler version 0.410002 and later. Users should upgrade to version 0.410002 or newer to remediate this vulnerability. Until upgraded, avoid building option lists from untrusted or attacker-controlled data sources or ensure proper escaping of labels before rendering.