CVE-2026-85485: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The vulnerability in HTML::FormHandler before version 0.410002 arises from improper neutralization of input during web page generation (CWE-79). Error messages that include attacker-influenced content, such as rejected field values, are rendered into HTML without proper escaping in the Table form layout and Bootstrap 2 and 3 wrappers. This allows an attacker to inject JavaScript code into rendered pages, leading to cross-site scripting. The fix was introduced in version 0.410002, which added escaping for these specific layouts and wrappers, mitigating the vulnerability.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the affected web application, potentially leading to information disclosure and limited integrity impact. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact. There is no known exploitation in the wild.

Upgrade HTML::FormHandler to version 0.410002 or later, which includes the official fix that properly escapes error messages in the affected form layouts and wrappers. No additional mitigation is required once the upgrade is applied.