The Table form layout and the Bootstrap 2 and 3 wrappers splice each error string straight into the surrounding markup. Version 0.410000, the fix for CVE-2026-19872, escaped the equivalent values in the other layouts and wrappers, and 0.410002 extended that to these three.
Error messages that contain attacker-influenced content such as rejected field values could embed JavaScript in rendered pages.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to HTML-FormHandler 0.410002 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 08 Sep 2026 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping. The Table form layout and the Bootstrap 2 and 3 wrappers splice each error string straight into the surrounding markup. Version 0.410000, the fix for CVE-2026-19872, escaped the equivalent values in the other layouts and wrappers, and 0.410002 extended that to these three. Error messages that contain attacker-influenced content such as rejected field values could embed JavaScript in rendered pages. | |
| Title | HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping | |
| Weaknesses | CWE-79 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-09-08T20:09:08.909Z
Reserved: 2026-09-03T21:29:54.878Z
Link: CVE-2026-85485
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-08T20:18:51.560
Modified: 2026-09-08T20:18:51.560
Link: CVE-2026-85485
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')