CVE-2026-85484 Details
Description
HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, Select into a label attribute and the other three into element content. RadioGroup also renders each radio button's own label unescaped. Any application whose option list is built from data rather than literals, using options_from, an options_fieldname method, or the DBIC model, allows attacker-influenced text in a label that can override the options or embed JavaScript in rendered pages.
A cross-site scripting vulnerability exists in HTML::FormHandler versions prior to 0.410002 for Perl. The issue arises because option group labels and radio button labels are rendered into HTML without proper escaping. This flaw is present in the Select, RadioGroup, CheckboxGroup, and HorizCheckboxGroup widgets, which all render labels unescaped, with Select placing them in a label attribute and the others in element content. Additionally, RadioGroup renders each radio button's label unescaped. Applications that build option lists from data rather than literals, using methods like options_from, options_fieldname, or the DBIC model, may inadvertently allow attacker-controlled text in labels. This could be exploited to manipulate options or inject JavaScript into the rendered page.
Users are advised to upgrade to HTML::FormHandler version 0.410002 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 8, 2026CISA-ADP
Assessed Sep 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gshank/html-formhandler/commit/49b562e0fed5146fc1a372c5fa8a879876b8841d.patch | CPANSec | Source Code |
| https://metacpan.org/release/ABRAXXA/HTML-FormHandler-0.410002/changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/09/08/16 | CVE | AdvisoryMailing ListRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| HTML::FormHandler | < 0.410002 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | CISA-ADP |
| Sep 8, 2026 | CVE Modified | CVE |
| Sep 8, 2026 | New CVE Received | CPANSec |