CVE-2026-85630: HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method
HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method.
Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value that can override the field attributes or embed JavaScript in rendered pages.
For example, the RadioGroup widget uses the processattrs method via the renderoption and wrapradio methods.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HTML::FormHandlerto a version that resolves this vulnerability.Fixed in 0.410002
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using HTML::FormHandler before 0.410002 are exposed when field attributes or field-label attributes are built from data rather than fixed literals. The RadioGroup widget is specifically relevant because its render_option and wrap_radio paths use process_attrs.
What must an attacker control to exploit it?
An attacker needs to influence text that is placed into a field or field-label attribute value. Because process_attrs does not escape that text, it can override intended attributes or inject JavaScript into the rendered page.
Are applications using only static form attributes affected?
The described exposure requires attributes to be built from data rather than literals. Forms whose relevant attributes are fixed literals are not described as vulnerable through this condition.
What version addresses the issue?
Upgrade HTML::FormHandler to version 0.410002 or later. Versions before 0.410002 are affected.