CVE-2026-85484: HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping
HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping.
The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, Select into a label attribute and the other three into element content. RadioGroup also renders each radio button's own label unescaped.
Any application whose option list is built from data rather than literals, using optionsfrom, an optionsfieldname method, or the DBIC model, allows attacker-influenced text in a label that can override the options or embed JavaScript in rendered pages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HTML::FormHandlerto a version that resolves this vulnerability.Fixed in 0.410002
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications using HTML::FormHandler before 0.410002 are exposed when they build option lists from data rather than fixed literals through options_from, an options_fieldname method, or the DBIC model. Attacker-influenced text must be able to reach an option-group label or, for RadioGroup, an individual radio-button label.
Which widgets and output locations are affected?
Select, RadioGroup, CheckboxGroup, and HorizCheckboxGroup render group labels without escaping. Select places the group label in a label attribute, while the other three render it as element content; RadioGroup also renders each individual radio-button label unescaped.
What must an attacker be able to control to exploit this?
An attacker needs to influence label text supplied through a data-backed option list. That text can then override options or embed JavaScript in the rendered page.
What version addresses the issue?
Version 0.410002 addresses the issue. Versions before 0.410002 are affected.