Source: libhtml-formhandler-perl Version: 0.40068-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for libhtml-formhandler-perl. CVE-2026-19872[0]: | HTML::FormHandler versions before 0.410000 for Perl allow cross-site | scripting via a submitted value rendered unescaped in an error | message. The wrappers and renderers that emit a form's errors | interpolate the error string straight into HTML with no escaping. | Two of the library's own messages, no_match and not_allowed, splice | the submitted value into that string, and a failing type constraint | puts the rejected value into the message it builds, which | _apply_actions hands to add_error. A field declared with a check | regexp, a check list or a type constraint reaches those messages, | with no custom validator and no non-default configuration. Errors | rendered through an application's own escaping template layer rather | than the library's rendering roles are not affected. A request over | the network that submits markup to such a field gets it back live | inside the error span, running script in the victim's origin. Re- | rendering a rejected value later gives the stored variant. CVE-2026-85484[1]: | HTML::FormHandler versions before 0.410002 for Perl render option | group labels and radio button labels into HTML without escaping. | The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets | render a group label unescaped, Select into a label attribute and | the other three into element content. RadioGroup also renders each | radio button's own label unescaped. Any application whose option | list is built from data rather than literals, using options_from, an | options_fieldname method, or the DBIC model, allows attacker- | influenced text in a label that can override the options or embed | JavaScript in rendered pages. CVE-2026-85485[2]: | HTML::FormHandler versions before 0.410002 for Perl render some error | messages into HTML without escaping. The Table form layout and the | Bootstrap 2 and 3 wrappers splice each error string straight into the | surrounding markup. Version 0.410000, the fix for CVE-2026-19872, | escaped the equivalent values in the other layouts and wrappers, and | 0.410002 extended that to these three. Error messages that contain attacker- | influenced content such as rejected field values could embed | JavaScript in rendered pages. CVE-2026-85630[3]: | HTML::FormHandler versions before 0.410002 for Perl render field | attributes into HTML without escaping using the process_attrs | method. Any application with fields or field labels where some | attributes are built from data rather than literals allows attacker- | influenced text in an attribute value that can override the field | attributes or embed JavaScript in rendered pages. For example, the | RadioGroup widget uses the process_attrs method via the | render_option and wrap_radio methods. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-19872 https://www.cve.org/CVERecord?id=CVE-2026-19872 [1] https://security-tracker.debian.org/tracker/CVE-2026-85484 https://www.cve.org/CVERecord?id=CVE-2026-85484 [2] https://security-tracker.debian.org/tracker/CVE-2026-85485 https://www.cve.org/CVERecord?id=CVE-2026-85485 [3] https://security-tracker.debian.org/tracker/CVE-2026-85630 https://www.cve.org/CVERecord?id=CVE-2026-85630 Regards, Salvatore
