Quick answers
- Is CVE-2026-19872 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-19872 being exploited in the wild.
- How severe is CVE-2026-19872?
- Medium severity, with a CVSS score of 6.1, published 8 September 2026.
- Which products and versions are affected?
- HTML::FormHandler before 0.410000.
- Is there a fix for CVE-2026-19872?
- A patch was published on 2026-08-17: Fix applied in commit 2574fdb with version 0.410000 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-19872 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-19872?
- Check whether you run HTML::FormHandler at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in HTML::FormHandler's form rendering system. The wrappers and renderers that emit form errors do not HTML-escape error strings before interpolating them into HTML output. Error messages generated by built-in constraints (such as "no_match" and "not_allowed") or type validation failures include the rejected user input directly into the error message text. An attacker can submit HTML/JavaScript markup to any field with a check regexp, check list, or type constraint, and this markup is rendered unescaped in the error span, executing in the victim's browser context. The vulnerability affects applications using HTML::FormHandler's rendering roles; applications with their own escaping template layers are unaffected. The fix was patched in version 0.410000 by HTML-escaping all error messages during rendering.
Affected products
- HTML::FormHandler HTML::FormHandler before 0.410000
Timeline
- 2026-09-08: disclosed
- 2026-08-17: patched: Fix applied in commit 2574fdb with version 0.410000