CVE-2026-85484

HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, Select into a label attribute and the other three into element content. RadioGroup also renders each radio button's own label unescaped. Any application whose option list is built from data rather than literals, using options_from, an options_fieldname method, or the DBIC model, allows attacker-influenced text in a label that can override the options or embed JavaScript in rendered pages.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/gshank/html-formhandler/commit/49b562e0fed5146fc1a372c5fa8a879876b8841d.patch
https://metacpan.org/release/ABRAXXA/HTML-FormHandler-0.410002/changes
http://www.openwall.com/lists/oss-security/2026/09/08/16

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-08 20:18

Updated : 2026-09-10 18:18

NVD link : CVE-2026-85484

Mitre link : CVE-2026-85484

CVE.ORG link : CVE-2026-85484

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-85484", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-85484", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-10T17:50:26.179136Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/gshank/html-formhandler", "modules": ["HTML::FormHandler"], "versions": [{"status": "affected", "version": "0", "lessThan": "0.410002", "versionType": "custom"}], "packageURL": "pkg:cpan/HTML-FormHandler", "packageName": "HTML-FormHandler", "programFiles": ["lib/HTML/FormHandler/Widget/Field/CheckboxGroup.pm", "lib/HTML/FormHandler/Widget/Field/HorizCheckboxGroup.pm", "lib/HTML/FormHandler/Widget/Field/RadioGroup.pm", "lib/HTML/FormHandler/Widget/Field/Select.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "HTML::FormHandler::Widget::Field::CheckboxGroup::render_element"}, {"name": "HTML::FormHandler::Widget::Field::HorizCheckboxGroup::render_element"}, {"name": "HTML::FormHandler::Widget::Field::RadioGroup::render_element"}, {"name": "HTML::FormHandler::Widget::Field::RadioGroup::wrap_radio"}, {"name": "HTML::FormHandler::Widget::Field::Select::render_element"}]}]}], "published": "2026-09-08T20:18:51.453", "references": [{"url": "https://github.com/gshank/html-formhandler/commit/49b562e0fed5146fc1a372c5fa8a879876b8841d.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/ABRAXXA/HTML-FormHandler-0.410002/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/09/08/16", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping.\n\nThe Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, Select into a label attribute and the other three into element content. RadioGroup also renders each radio button's own label unescaped.\n\nAny application whose option list is built from data rather than literals, using options_from, an options_fieldname method, or the DBIC model, allows attacker-influenced text in a label that can override the options or embed JavaScript in rendered pages."}], "lastModified": "2026-09-10T18:18:09.550", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}