CVE-2026-19872
UnknownSummary
HTML::FormHandler before version 0.410000 for Perl allows cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. The no_match and not_allowed messages splice the submitted value into that string, and a failing type constraint puts the rejected value into the message. A network request submitting markup to such a field can cause script execution in the victim's context.
Risk Assessment
The risk includes cross-site scripting (XSS) both reflected and stored, which could lead to data theft, session hijacking, or other malicious activities.
Recommendation
Upgrade HTML::FormHandler to version 0.410000 or later. Ensure error messages are properly escaped.
Other vulnerabilities in HTML::FormHandler
See all- CVE-2026-85630Unknown
HTML::FormHandler before version 0.410002 for Perl renders field attributes into HTML without escaping using the process_attrs method. Applications with fields or labels where attributes are built from data rather than literals may allow attacker-influenced text in attribute values, potentially overriding field attributes or embedding JavaScript in rendered pages.
- CVE-2026-85485Unknown
HTML::FormHandler before version 0.410002 for Perl renders some error messages into HTML without escaping. The Table form layout and Bootstrap 2 and 3 wrappers splice each error string directly into the surrounding markup. Error messages containing attacker-influenced content such as rejected field values could embed JavaScript in rendered pages.
- CVE-2026-85484Unknown
HTML::FormHandler before version 0.410002 for Perl renders option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, and RadioGroup also renders each radio button's own label unescaped. Applications whose option list is built from data may allow attacker-influenced text in a label, potentially overriding options or embedding JavaScript.
- CVE-2022-4993Critical
Vulnerability in HTML::FormHandler before version 0.410000 for Perl allows attacker-selected method dispatch and resource exhaustion. This occurs because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template, potentially leading to dangerous method calls or memory allocation.
Original NVD description (English source)
HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages, no_match and not_allowed, splice the submitted value into that string, and a failing type constraint puts the rejected value into the message it builds, which _apply_actions hands to add_error. A field declared with a check regexp, a check list or a type constraint reaches those messages, with no custom validator and no non-default configuration. Errors rendered through an application's own escaping template layer rather than the library's rendering roles are not affected. A request over the network that submits markup to such a field gets it back live inside the error span, running script in the victim's origin. Re-rendering a rejected value later gives the stored variant.