CVE-2026-85484

Deferred Deferred - Pending Action

XSS in HTML::FormHandler Perl Module

Publication date: 2026-09-08

Last updated on: 2026-09-10

Assigner: CPANSec

Description

HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, Select into a label attribute and the other three into element content. RadioGroup also renders each radio button's own label unescaped. Any application whose option list is built from data rather than literals, using options_from, an options_fieldname method, or the DBIC model, allows attacker-influenced text in a label that can override the options or embed JavaScript in rendered pages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-85484

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

HTML::FormHandler versions before 0.410002 for Perl do not escape option group labels and radio button labels when rendering them into HTML. This affects Select, RadioGroup, CheckboxGroup, and HorizCheckboxGroup widgets. Attackers can inject malicious text into labels, potentially overriding options or embedding JavaScript in rendered pages if option lists are built from user-controlled data.

Detection Guidance

To detect this vulnerability, inspect Perl applications using HTML::FormHandler versions before 0.410002. Check for dynamic label generation in Select, RadioGroup, CheckboxGroup, or HorizCheckboxGroup widgets. Review HTML output for unescaped labels that could indicate XSS risks.

Impact Analysis

This vulnerability allows attackers to inject malicious JavaScript or override form options by manipulating labels. If your application uses HTML::FormHandler with dynamically generated option lists, attackers could execute cross-site scripting (XSS) attacks, steal user data, or alter form behavior without proper escaping.

Compliance Impact

This vulnerability could lead to XSS attacks, which may result in unauthorized data access or manipulation. Such incidents could violate GDPR's data protection requirements or HIPAA's security rules, potentially leading to legal penalties, reputational damage, and loss of user trust due to non-compliance with data security standards.

Mitigation Strategies

Upgrade HTML::FormHandler to version 0.410002 or later. Ensure all label inputs are properly sanitized before rendering. Review and test affected widgets for proper HTML escaping in dynamic label generation.

Hi! I’m here to help you understand CVE-2026-85484. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70