CVE-2026-85630: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-85630 is a cross-site scripting vulnerability in HTML::FormHandler for Perl, present in versions prior to 0.410002. The vulnerability arises because the process_attrs method renders field attributes into HTML without proper escaping. Applications that build field attributes from user-influenced data can be exploited to inject malicious scripts, as demonstrated in the RadioGroup widget's render_option and wrap_radio methods. This improper neutralization of input during web page generation is classified under CWE-79.

An attacker can inject malicious JavaScript into attribute values of form fields, potentially leading to cross-site scripting attacks. This can result in partial confidentiality and integrity loss (e.g., theft of user data or session tokens) but does not affect availability. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and scope change.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor or CPAN security advisories for updates. Until a fix is available, avoid using untrusted input in field attributes or apply manual escaping of attribute values in application code to prevent injection. Review usage of the process_attrs method and related widgets such as RadioGroup for unsafe input handling.