CVE-2026-85485: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

HTML::FormHandler versions prior to 0.410002 for Perl improperly neutralize input during web page generation, specifically in the Table form layout and Bootstrap 2 and 3 wrappers. These components splice error messages directly into HTML without escaping, enabling injection of JavaScript if error messages contain attacker-influenced content such as rejected field values. Version 0.410000 addressed similar issues in other layouts and wrappers, and 0.410002 extended escaping to the affected three layouts, mitigating this vulnerability.

An attacker can inject malicious JavaScript code into error messages rendered by vulnerable versions of HTML::FormHandler, potentially leading to cross-site scripting attacks. This can result in limited confidentiality and integrity impacts, such as theft of user data or session tokens, but does not affect availability. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Upgrade HTML::FormHandler to version 0.410002 or later, where the vulnerability is fixed by proper escaping of error messages in the affected form layouts and wrappers. No other specific mitigations are indicated. Patch status is confirmed fixed in 0.410002.