HTML::FormHandler XSS via Unescaped Error Messages

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: CPANSec

Description

HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping. The Table form layout and the Bootstrap 2 and 3 wrappers splice each error string straight into the surrounding markup. Version 0.410000, the fix for CVE-2026-19872, escaped the equivalent values in the other layouts and wrappers, and 0.410002 extended that to these three. Error messages that contain attacker-influenced content such as rejected field values could embed JavaScript in rendered pages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-09

AI Q&A

2026-09-09

EPSS Evaluated

N/A

NVD

CVE-2026-85485

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

HTML::FormHandler versions before 0.410002 for Perl have a flaw where error messages are rendered into HTML without proper escaping in certain form layouts and wrappers.

Impact Analysis

Attackers could inject malicious JavaScript into error messages by submitting crafted field values, which would then execute when the page is viewed by other users.

Mitigation Strategies

Update HTML::FormHandler to version 0.410002 or later to ensure proper escaping of error messages in HTML output.

Hi! I’m here to help you understand CVE-2026-85485. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70