Executive brief
HTML::FormHandler is a Perl library used to generate and validate HTML forms. The library fails to escape user-submitted values when rendering form validation error messages in HTML, allowing an attacker to inject malicious scripts that execute in the victim's browser. This affects any web application using HTML::FormHandler to display form errors to users.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in HTML::FormHandler's form rendering system. The wrappers and renderers that emit form errors do not HTML-escape error strings before interpolating them into HTML output. Error messages generated by built-in constraints (such as "no_match" and "not_allowed") or type validation failures include the rejected user input directly into the error message text. An attacker can submit HTML/JavaScript markup to any field with a check regexp, check list, or type constraint, and this markup is rendered unescaped in the error span, executing in the victim's browser context. The vulnerability affects applications using HTML::FormHandler's rendering roles; applications with their own escaping template layers are unaffected. The fix was patched in version 0.410000 by HTML-escaping all error messages during rendering.
Affected products
- HTML::FormHandler HTML::FormHandler before 0.410000
Timeline
- 2026-09-08: disclosed
- 2026-08-17: patched: Fix applied in commit 2574fdb with version 0.410000