A flaw in Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 allows an attacker to trigger the HTML::Tidy module to return diagnostics that are then passed as a Locale::Maketext template key to the add_error method. Because the default language handle treats unknown keys as bracket‑notation templates, the diagnostic string can be crafted to compile into arbitrary method calls on the language handle or to explode the CORE::sprintf function with an attacker‑selected width. Exploiting this mechanism can result in an unhandled exception that crashes the application or, if the language handle contains side‑effecting public methods, can execute arbitrary code or exhaust system resources.

The vulnerability affects Perl installations that use the Form-Processor distribution, specifically the Form::Processor::Field::HtmlArea component, in any release from 0.06 up to and including 1.162360. Applications that enable the HtmlArea field type and supply a custom Locale::Maketext language handle are at risk. No other Form-Processor field types experience this flaw.

The exploit requires remote submission of specially crafted markup to a form that contains an HtmlArea field. An attacker can trigger a runtime exception or cause arbitrary memory allocation, and if the language handle provides callable public methods with side effects, they can be invoked with attacker‑chosen arguments. Although EPSS data is not available and the vulnerability is not listed in CISA KEV, the potential for remote code execution and denial of service places the risk high; patching or mitigating the vulnerable field is strongly recommended.