CVE-2026-85484
UnknownSummary
HTML::FormHandler before version 0.410002 for Perl renders option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, and RadioGroup also renders each radio button's own label unescaped. Applications whose option list is built from data may allow attacker-influenced text in a label, potentially overriding options or embedding JavaScript.
Risk Assessment
The risk includes cross-site scripting (XSS) and manipulation of form options, which could lead to unauthorized actions or data theft.
Recommendation
Upgrade HTML::FormHandler to version 0.410002 or later. Ensure option labels are properly escaped.
Other vulnerabilities in HTML::FormHandler
See all- CVE-2026-85630Unknown
HTML::FormHandler before version 0.410002 for Perl renders field attributes into HTML without escaping using the process_attrs method. Applications with fields or labels where attributes are built from data rather than literals may allow attacker-influenced text in attribute values, potentially overriding field attributes or embedding JavaScript in rendered pages.
- CVE-2026-85485Unknown
HTML::FormHandler before version 0.410002 for Perl renders some error messages into HTML without escaping. The Table form layout and Bootstrap 2 and 3 wrappers splice each error string directly into the surrounding markup. Error messages containing attacker-influenced content such as rejected field values could embed JavaScript in rendered pages.
- CVE-2026-19872Unknown
HTML::FormHandler before version 0.410000 for Perl allows cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. The no_match and not_allowed messages splice the submitted value into that string, and a failing type constraint puts the rejected value into the message. A network request submitting markup to such a field can cause script execution in the victim's context.
- CVE-2022-4993Critical
Vulnerability in HTML::FormHandler before version 0.410000 for Perl allows attacker-selected method dispatch and resource exhaustion. This occurs because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template, potentially leading to dangerous method calls or memory allocation.
Original NVD description (English source)
HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, Select into a label attribute and the other three into element content. RadioGroup also renders each radio button's own label unescaped. Any application whose option list is built from data rather than literals, using options_from, an options_fieldname method, or the DBIC model, allows attacker-influenced text in a label that can override the options or embed JavaScript in rendered pages.