CVE-2026-85630: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

HTML::FormHandler versions prior to 0.410002 for Perl contain an XSS vulnerability due to improper escaping of field attributes in the process_attrs method. Applications that build some field attributes from dynamic data rather than literals can be exploited by attackers to inject malicious scripts. The vulnerability is exemplified in the RadioGroup widget, which uses process_attrs through render_option and wrap_radio methods, enabling injection of JavaScript into rendered HTML pages.

This vulnerability allows an attacker to inject malicious JavaScript into web pages generated by affected applications, potentially leading to cross-site scripting attacks. The impact includes limited confidentiality and integrity loss, with no direct availability impact. The CVSS score of 6.1 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor or CPANSec advisories for updates. Until a fix is available, avoid using untrusted data in field attributes or apply manual escaping to prevent injection. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.