CVE-2026-85485 Overview
CVE-2026-85485 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Perl module HTML::FormHandler before version 0.410002. The Table form layout and the Bootstrap 2 and 3 wrappers splice error message strings directly into rendered markup without HTML encoding. When error messages include attacker-influenced content such as rejected field values, the unescaped output can execute JavaScript in a victim's browser. This flaw is a regression gap from the earlier fix for CVE-2026-19872, which addressed equivalent unescaped output in other layouts and wrappers but missed these three code paths.
Critical Impact
Reflected XSS through form error rendering allows attackers to execute arbitrary JavaScript in the context of any application using the affected Table or Bootstrap 2/3 layouts.
Affected Products
- HTML::FormHandler for Perl, all versions before 0.410002
- Applications using the HTML::FormHandler::Widget::Form::Table layout
- Applications using the HTML::FormHandler Bootstrap 2 or Bootstrap 3 wrappers
Discovery Timeline
- 2026-09-08 - CVE-2026-85485 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-85485
Vulnerability Analysis
The vulnerability exists in the rendering layer of HTML::FormHandler. When a form field fails validation, the module builds an HTML fragment containing the error message. In the affected code paths, that fragment is concatenated into the output without passing through an HTML encoder. If the error string reflects attacker-controlled data, such as a rejected value returned in a message like `
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.