CVE-2026-85630 Details
Description
HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method. Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value that can override the field attributes or embed JavaScript in rendered pages. For example, the RadioGroup widget uses the process_attrs method via the render_option and wrap_radio methods.
A cross-site scripting vulnerability exists in HTML::FormHandler versions prior to 0.410002 for Perl. The issue arises because the process_attrs method renders field attributes into HTML without proper escaping. This flaw allows attacker-controlled text to be injected into attribute values, potentially overriding field attributes or embedding JavaScript in the rendered page. The vulnerability is particularly relevant for applications using the RadioGroup widget, which can be exploited through the render_option and wrap_radio methods.
Upgrade to HTML::FormHandler version 0.410002 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 8, 2026CISA-ADP
Assessed Sep 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gshank/html-formhandler/commit/a887271e91d755e6486a9f433ae932deb1d2c4a6.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/ABRAXXA/HTML-FormHandler-0.410002/changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/09/08/18 | CVE | AdvisoryMailing ListRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| HTML::FormHandler | < 0.410002 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | CISA-ADP |
| Sep 8, 2026 | CVE Modified | CVE |
| Sep 8, 2026 | New CVE Received | CPANSec |