Threat Intelligence Database

HTML::FormHandler versions before 0.410002 for Perl have a cross-site scripting (XSS) vulnerability due to improper escaping of field attributes in HTML output. This allows attacker-controlled input to be injected into attribute values, potentially enabling JavaScript execution in rendered pages. The issue affects components like the RadioGroup widget that use the vulnerable process_attrs method.

CVE-2026-85485 is a cross-site scripting (XSS) vulnerability in HTML::FormHandler for Perl versions before 0.410002. Certain form layouts and wrappers render error messages into HTML without proper escaping, allowing attacker-controlled input to inject JavaScript into rendered pages. This issue was fixed in version 0.410002 by escaping error strings in the affected layouts and wrappers.

HTML::FormHandler versions before 0.410002 for Perl improperly escape group and radio button labels in certain widgets, leading to cross-site scripting (XSS) vulnerabilities. Specifically, Select, RadioGroup, CheckboxGroup, and HorizCheckboxGroup widgets render labels without proper HTML escaping, allowing attacker-controlled input to inject JavaScript. This affects applications that build option lists from dynamic data sources. The vulnerability has a medium severity with a CVSS score of 6.1.

HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages, no_match and not_allowed, splice the submitted value into that string, and a failing type constraint puts the rejected value into the message it builds, which _apply_actions hands to add_error. A field declared with a check regexp, a check list or a type constraint reaches those messages, with no custom validator and no non-default configuration. Errors rendered through an application's own escaping template layer rather than the library's rendering roles are not affected. A request over the network that submits markup to such a field gets it back live inside the error span, running script in the victim's origin. Re-rendering a rejected value later gives the stored variant.