Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-19872

HTML-FormHandler · cross-site scripting

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-19872

Published

HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages, no_match and not_allowed, splice the submitted value into that string, and a failing type constraint puts the rejected value into the message it builds, which _apply_actions hands to add_error. A field declared with a check regexp, a check list or a type constraint reaches those messages, with no custom validator and no non-default configuration. Errors rendered through an application's own escaping template layer rather than the library's rendering roles are not affected. A request over the network that submits markup to such a field gets it back live inside the error span, running script in the victim's origin. Re-rendering a rejected value later gives the stored variant.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-19872

Published

HTML-FormHandler

https://cpan.org/modules

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "collectionURL": "https://cpan.org/modules",
                    "defaultStatus": "unaffected",
                    "modules": [
                        "HTML::FormHandler"
                    ],
                    "packageName": "HTML-FormHandler",
                    "packageURL": "pkg:cpan/HTML-FormHandler",
                    "programFiles": [
                        "lib/HTML/FormHandler/Validate.pm",
                        "lib/HTML/FormHandler/Render/Simple.pm",
                        "lib/HTML/FormHandler/Render/Table.pm",
                        "lib/HTML/FormHandler/Widget/Form/Simple.pm",
                        "lib/HTML/FormHandler/Widget/Theme/BootstrapFormMessages.pm",
                        "lib/HTML/FormHandler/Widget/Wrapper/Fieldset.pm",
                        "lib/HTML/FormHandler/Widget/Wrapper/Simple.pm",
                        "lib/HTML/FormHandler/Widget/Wrapper/SimpleInline.pm",
                        "lib/HTML/FormHandler/Widget/Wrapper/Table.pm",
                        "lib/HTML/FormHandler/Widget/Wrapper/TableInline.pm"
                    ],
                    "programRoutines": [
                        {
                            "name": "HTML::FormHandler::Validate::_apply_actions"
                        },
                        {
                            "name": "HTML::FormHandler::Render::Simple::render_form_errors"
                        },
                        {
                            "name": "HTML::FormHandler::Render::Simple::wrap_field"
                        },
                        {
                            "name": "HTML::FormHandler::Render::Table::render_form_errors"
                        },
                        {
                            "name": "HTML::FormHandler::Render::Table::wrap_field"
                        },
                        {
                            "name": "HTML::FormHandler::Widget::Form::Simple::render_form_messages"
                        },
                        {
                            "name": "HTML::FormHandler::Widget::Theme::BootstrapFormMessages::render_form_messages"
                        },
                        {
                            "name": "HTML::FormHandler::Widget::Wrapper::Fieldset::wrap_field"
                        },
                        {
                            "name": "HTML::FormHandler::Widget::Wrapper::Simple::wrap_field"
                        },
                        {
                            "name": "HTML::FormHandler::Widget::Wrapper::SimpleInline::wrap_field"
                        },
                        {
                            "name": "HTML::FormHandler::Widget::Wrapper::Table::wrap_field"
                        },
                        {
                            "name": "HTML::FormHandler::Widget::Wrapper::TableInline::wrap_field"
                        }
                    ],
                    "repo": "https://github.com/gshank/html-formhandler",
                    "versions": [
                        {
                            "lessThan": "0.410000",
                            "status": "affected",
                            "version": "0",
                            "versionType": "custom"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON