Executive brief
HTML::FormHandler is a Perl library used to generate and validate web forms. Versions before 0.410002 render form error messages directly into HTML markup without escaping special characters, allowing attackers to inject JavaScript code through rejected field values. This could lead to credential theft, session hijacking, or malware distribution when an attacker tricks users into submitting forms with malicious input.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the Table form layout and Bootstrap 2 and 3 theme wrappers of HTML::FormHandler. Error messages containing user-controlled content (such as rejected form field values) are spliced directly into HTML output without HTML entity encoding. An attacker can submit forms with JavaScript payloads in field values; when the form validates and rejects the input, the error messages render the attacker's code unescaped in the page. A prior fix (CVE-2026-19872) addressed this in other layouts, but overlooked these three components. Version 0.410002 extends HTML entity encoding to the affected areas using the encode_entities() function.
Affected products
- HTML::FormHandler Project HTML::FormHandler before 0.410002
Timeline
- 2026-09-08: disclosed: CVE-2026-85485 published
- 2026-09-04: patched: Version 0.410002 released with fix