CVE-2026-85630

Received Received - Intake

Stored XSS in HTML::FormHandler Perl Module

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: CPANSec

Description

HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method. Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value that can override the field attributes or embed JavaScript in rendered pages. For example, the RadioGroup widget uses the process_attrs method via the render_option and wrap_radio methods.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-09

AI Q&A

2026-09-09

EPSS Evaluated

N/A

NVD

CVE-2026-85630

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability affects HTML::FormHandler versions before 0.410002 for Perl. It allows attackers to inject malicious text into HTML attributes by exploiting unescaped field attributes rendered via the process_attrs method. This could lead to JavaScript execution or attribute manipulation in web pages.

Detection Guidance

This vulnerability can be detected by reviewing Perl applications using HTML::FormHandler versions before 0.410002. Check for fields or field labels where attributes are built from user-controlled data. Inspect the process_attrs method usage in widgets like RadioGroup.

Impact Analysis

If you use an affected version of HTML::FormHandler, attackers could manipulate form fields or labels to execute malicious scripts in your application. This may result in data theft, session hijacking, or defacement of your web pages.

Mitigation Strategies

Upgrade HTML::FormHandler to version 0.410002 or later. Review and sanitize all field attributes to ensure they do not contain user-controlled data. Replace dynamic attribute values with static literals where possible.

Hi! I’m here to help you understand CVE-2026-85630. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70