Is CVE-2026-85485 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85485 being exploited in the wild.

How severe is CVE-2026-85485?

Medium severity, with a CVSS score of 6.1, published 8 September 2026.

Which products and versions are affected?

HTML::FormHandler Project HTML::FormHandler before 0.410002.

Is there a fix for CVE-2026-85485?

A patch was published on 2026-09-04: Version 0.410002 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85485 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-85485?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85485: HTML::FormHandler stored XSS in error messages

CVE-2026-85485 · Severity: medium · CVSS 6.1 · Published 2026-09-08

HTML::FormHandler is a Perl library used to generate and validate web forms. Versions before 0.410002 render form error messages directly into HTML markup without escaping special characters, allowing attackers to inject JavaScript code through rejected field values. This could lead to credential theft, session hijacking, or malware distribution when an attacker tricks users into submitting forms with malicious input.

Quick answers

Is CVE-2026-85485 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85485 being exploited in the wild.
How severe is CVE-2026-85485?: Medium severity, with a CVSS score of 6.1, published 8 September 2026.
Which products and versions are affected?: HTML::FormHandler Project HTML::FormHandler before 0.410002.
Is there a fix for CVE-2026-85485?: A patch was published on 2026-09-04: Version 0.410002 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85485 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-85485?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a cross-site scripting (XSS) flaw in the Table form layout and Bootstrap 2 and 3 theme wrappers of HTML::FormHandler. Error messages containing user-controlled content (such as rejected form field values) are spliced directly into HTML output without HTML entity encoding. An attacker can submit forms with JavaScript payloads in field values; when the form validates and rejects the input, the error messages render the attacker's code unescaped in the page. A prior fix (CVE-2026-19872) addressed this in other layouts, but overlooked these three components. Version 0.410002 extends HTML entity encoding to the affected areas using the encode_entities() function.

Affected products

HTML::FormHandler Project HTML::FormHandler before 0.410002

Timeline

2026-09-08: disclosed: CVE-2026-85485 published
2026-09-04: patched: Version 0.410002 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.