Executive brief
HTML::FormHandler is a Perl library for building and rendering web forms. The library failed to escape option group labels and radio button labels when rendering form widgets, allowing attackers to inject JavaScript or HTML into form pages if the option list is populated from untrusted data sources (such as databases or user input). This could lead to session hijacking, credential theft, or malware distribution to users viewing the form.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the form field widgets (Select, RadioGroup, CheckboxGroup, and HorizCheckboxGroup) of HTML::FormHandler. The Select widget renders option group labels unescaped into HTML label attributes, while the other three widgets render group labels unescaped into element content. RadioGroup additionally renders individual radio button labels unescaped. When option lists are dynamically built using methods like options_from, options_fieldname methods, or DBIC models—rather than hardcoded literals—attacker-controlled text in labels bypasses output encoding. The attack requires that an application populate form options from untrusted data. The fix applies HTML encoding (html_filter) to all label values before rendering. Patches are available in commit 49b562e0fed5146fc1a372c5fa8a879876b8841d and version 0.410002.
Affected products
- HTML::FormHandler HTML::FormHandler before 0.410002
Timeline
- 2026-09-08: disclosed
- 2026-09-04: patched: Fix committed on 2026-09-04; version 0.410002 released with patch