# CVE-2026-19872: HTML::FormHandler cross-site scripting in error messages

Source: https://junglewise.ai/threats/cve-2026-19872-html-formhandler-cross-site-scripting-in-error-messages  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-19872 · Severity: medium · CVSS 6.1 · Published 2026-09-08

HTML::FormHandler is a Perl library used to generate and validate HTML forms. The library fails to escape user-submitted values when rendering form validation error messages in HTML, allowing an attacker to inject malicious scripts that execute in the victim's browser. This affects any web application using HTML::FormHandler to display form errors to users.

Technologies: [HTML::FormHandler](https://junglewise.ai/threats/technologies/html-formhandler). Vendors: [HTML::FormHandler](https://junglewise.ai/threats/vendors/html-formhandler).

## Quick answers

**Is CVE-2026-19872 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19872 being exploited in the wild.

**How severe is CVE-2026-19872?** Medium severity, with a CVSS score of 6.1, published 8 September 2026.

**Which products and versions are affected?** HTML::FormHandler before 0.410000.

**Is there a fix for CVE-2026-19872?** A patch was published on 2026-08-17: Fix applied in commit 2574fdb with version 0.410000 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19872 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-19872?** Check whether you run HTML::FormHandler at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in HTML::FormHandler's form rendering system. The wrappers and renderers that emit form errors do not HTML-escape error strings before interpolating them into HTML output. Error messages generated by built-in constraints (such as "no_match" and "not_allowed") or type validation failures include the rejected user input directly into the error message text. An attacker can submit HTML/JavaScript markup to any field with a check regexp, check list, or type constraint, and this markup is rendered unescaped in the error span, executing in the victim's browser context. The vulnerability affects applications using HTML::FormHandler's rendering roles; applications with their own escaping template layers are unaffected. The fix was patched in version 0.410000 by HTML-escaping all error messages during rendering.

## Affected products

- HTML::FormHandler HTML::FormHandler before 0.410000

## Timeline

- 2026-09-08: disclosed
- 2026-08-17: patched: Fix applied in commit 2574fdb with version 0.410000

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/gshank/html-formhandler/commit/2574fdb4561f5c32d44cfbfbb3188345d49eb5a2.patch](https://github.com/gshank/html-formhandler/commit/2574fdb4561f5c32d44cfbfbb3188345d49eb5a2.patch)

## Related threats

- [HTML::FormHandler XSS in option group and label rendering](https://junglewise.ai/threats/cve-2026-85484-html-formhandler-xss-in-option-group-and-label-rendering)