A flaw in the Perl module Form::Processor::Field::HtmlArea, affecting versions 0.06 through 1.162360, allows an attacker to craft form input that triggers the HTML::Tidy parser. Diagnostic messages produced by HTML::Tidy are passed to the module’s add_error routine as keys to a Locale::Maketext language handle. When the key is not found in the lexicon, the default handling treats it as a bracket‑notation template, which an attacker can manipulate to invoke arbitrary methods on the language handle or to invoke CORE::sprintf with an attacker‑chosen width. This can lead to unhandled exceptions, denial of service from excessive memory allocation, or execution of unintended code if the language handle implements public side‑effecting methods.

The vulnerability targets Perl applications that install the Form-Processor distribution, specifically the Form::Processor::Field::HtmlArea component, in any release from 0.06 to 1.162360. Applications that enable the HtmlArea field type and supply a custom Locale::Maketext language handle are at risk. No other Form-Processor field types are impacted by this flaw.

Exploitation requires the submission of intentionally crafted markup to a form containing an HtmlArea field. An attacker can provoke a crash or memory exhaustion, and if the language handle exposes unsafe public methods, arbitrary code may be executed. The CVSS score of 9.1 reflects the high severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation observed in the wild. The vulnerability is not listed in CISA KEV, but the presence of remote code execution and denial‑of‑service potential warrants immediate remediation.