CVE-2026-85484: HTML::FormHandler Perl XSS Vulnerability

CVE-2026-85484 Overview

CVE-2026-85484 is a Cross-Site Scripting (XSS) vulnerability in the HTML::FormHandler Perl module affecting versions before 0.410002. The module renders option group labels and radio button labels into HTML without applying HTML entity escaping. Affected widgets include Select, RadioGroup, CheckboxGroup, and HorizCheckboxGroup. Applications that build option lists from dynamic data sources such as options_from, an options_fieldname method, or the DBIC model are exposed. Attacker-influenced text placed in a label can override option markup or embed JavaScript in rendered pages.

Critical Impact
An attacker who can influence label text stored in application data can inject arbitrary HTML or JavaScript into rendered forms, enabling session theft, credential harvesting, or unauthorized actions in a victim's browser session.

Affected Products

HTML::FormHandler for Perl, all versions prior to 0.410002
Applications using the Select, RadioGroup, CheckboxGroup, or HorizCheckboxGroup widgets
Applications populating options via options_from, options_fieldname, or the DBIC model

Discovery Timeline

2026-09-08 - CVE CVE-2026-85484 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-85484

Vulnerability Analysis

The vulnerability is a stored or reflected Cross-Site Scripting flaw classified as [CWE-79]. HTML::FormHandler interpolates option group labels and individual radio button labels directly into generated HTML markup. The Select widget writes the group label into a label attribute, while RadioGroup, CheckboxGroup, and HorizCheckboxGroup render the group label into element content. RadioGroup additionally renders each radio option's own label unescaped. Any application whose option list is derived from user-influenced data, rather than static literals, can render attacker-controlled content into a victim's browser without sanitization.

Root Cause

The root cause is missing output encoding in the widget render routines. The affected code interpolates the $label variable directly into an HTML template string using Perl's qq{} operator without calling the framework's html_filter method. This bypasses the standard escaping applied to other user-facing form output.

Attack Vector

Exploitation requires an attacker to store or inject HTML payload text into a field consumed by the form's option list. Common sources include database columns rendered via DBIC, values returned by an options_fieldname method, or entries produced by options_from. When a victim loads the form, the browser parses the injected markup, executing script in the context of the vulnerable application's origin. User interaction is required to load the affected page.

text

# Patch excerpt from Changes file - fix CVE-2026-85484
 {{$NEXT}}
    - fix failing t/errors/maketext_inert_argument.t test with non-English locale
+   - fix CVE-2026-85484
+     by HTML encoding option-list labels

0.410001  2026-09-03 15:35:45+02:00 Europe/Vienna
    - add the missing Changes entry for CVE-2022-4993

perl

# Patch excerpt from lib/HTML/FormHandler/Widget/Field/CheckboxGroup.pm
            my $attr_str = process_attrs($attr);
            my $lattr = $option->{label_attributes} || {};
            my $lattr_str= process_attrs($lattr);
-            $output .= qq{\n<div$attr_str><label$lattr_str>$label</label>};
+            $output .= qq{\n<div$attr_str><label$lattr_str>} . $self->html_filter($label) . qq{</label>};
            foreach my $group_opt ( @{ $option->{options} } ) {
                $output .= $self->render_option( $group_opt, $result );
            }

Source: GitHub Commit Patch

Detection Methods for CVE-2026-85484

Indicators of Compromise

Rendered HTML pages containing unexpected <script>, <img onerror=>, or event-handler attributes inside <label> or <option> elements produced by HTML::FormHandler.
Database rows in tables backing form option lists containing HTML tags, angle brackets, or JavaScript URI schemes.
Web server logs showing form-load requests followed by outbound requests to attacker-controlled domains initiated from the same session.

Detection Strategies

Audit application source for use of Select, RadioGroup, CheckboxGroup, or HorizCheckboxGroup widgets combined with options_from, options_fieldname, or DBIC-backed option sources.
Inventory installed CPAN modules and flag any HTML::FormHandler release earlier than 0.410002.
Deploy Content Security Policy reporting to surface inline script execution on pages that render dynamic option lists.

Monitoring Recommendations

Enable browser CSP violation reporting for pages containing forms rendered by HTML::FormHandler widgets.
Monitor web application firewall logs for HTML or script payloads submitted to endpoints that later populate form options.
Track anomalous session activity such as unexpected form submissions or credential changes originating from newly rendered form pages.

How to Mitigate CVE-2026-85484

Immediate Actions Required

Upgrade HTML::FormHandler to version 0.410002 or later on all systems using the affected widgets.
Inventory all forms that source option data from databases or user-editable configuration and audit stored label values for HTML payloads.
Sanitize existing option-list data at rest by stripping or encoding HTML metacharacters before redeployment.

Patch Information

The maintainer released HTML::FormHandler version 0.410002 on CPAN, which applies HTML encoding to option-list labels via the module's html_filter method. Details are available in the MetaCPAN Release Changes, the GitHub Commit Patch, and the OpenWall OSS Security Update.

Workarounds

Pre-encode label values in application code before assigning them to the form's option list, using a helper such as HTML::Entities::encode_entities.
Restrict write access to database tables and configuration sources that feed form option lists to trusted administrators only.
Deploy a strict Content Security Policy that disallows inline scripts to reduce the impact of successful injection.

bash

# Upgrade HTML::FormHandler via cpanm to the patched release
cpanm HTML::FormHandler@0.410002

# Verify installed version
perl -MHTML::FormHandler -E 'say $HTML::FormHandler::VERSION'