# CVE-2026-85484: HTML::FormHandler XSS in option group and label rendering

Source: https://junglewise.ai/threats/cve-2026-85484-html-formhandler-xss-in-option-group-and-label-rendering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85484 · Severity: medium · CVSS 6.1 · Published 2026-09-08

HTML::FormHandler is a Perl library for building and rendering web forms. The library failed to escape option group labels and radio button labels when rendering form widgets, allowing attackers to inject JavaScript or HTML into form pages if the option list is populated from untrusted data sources (such as databases or user input). This could lead to session hijacking, credential theft, or malware distribution to users viewing the form.

Technologies: [HTML::FormHandler](https://junglewise.ai/threats/technologies/html-formhandler). Vendors: [HTML::FormHandler](https://junglewise.ai/threats/vendors/html-formhandler).

## Quick answers

**Is CVE-2026-85484 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85484 being exploited in the wild.

**How severe is CVE-2026-85484?** Medium severity, with a CVSS score of 6.1, published 8 September 2026.

**Which products and versions are affected?** HTML::FormHandler before 0.410002.

**Is there a fix for CVE-2026-85484?** A patch was published on 2026-09-04: Fix committed on 2026-09-04; version 0.410002 released with patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85484 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-85484?** Check whether you run HTML::FormHandler at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cross-site scripting (XSS) flaw in the form field widgets (Select, RadioGroup, CheckboxGroup, and HorizCheckboxGroup) of HTML::FormHandler. The Select widget renders option group labels unescaped into HTML label attributes, while the other three widgets render group labels unescaped into element content. RadioGroup additionally renders individual radio button labels unescaped. When option lists are dynamically built using methods like options_from, options_fieldname methods, or DBIC models—rather than hardcoded literals—attacker-controlled text in labels bypasses output encoding. The attack requires that an application populate form options from untrusted data. The fix applies HTML encoding (html_filter) to all label values before rendering. Patches are available in commit 49b562e0fed5146fc1a372c5fa8a879876b8841d and version 0.410002.

## Affected products

- HTML::FormHandler HTML::FormHandler before 0.410002

## Timeline

- 2026-09-08: disclosed
- 2026-09-04: patched: Fix committed on 2026-09-04; version 0.410002 released with patch

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/gshank/html-formhandler/commit/49b562e0fed5146fc1a372c5fa8a879876b8841d.patch](https://github.com/gshank/html-formhandler/commit/49b562e0fed5146fc1a372c5fa8a879876b8841d.patch)

## Related threats

- [HTML::FormHandler cross-site scripting in error messages](https://junglewise.ai/threats/cve-2026-19872-html-formhandler-cross-site-scripting-in-error-messages)