https://bugzilla.redhat.com/show_bug.cgi?id=2533728
Bug ID: 2533728
Summary: CVE-2026-85484 perl-HTML-FormHandler:
HTML::FormHandler: Cross-Site Scripting (XSS) via
unescaped HTML labels [fedora-all]
Product: Fedora
Version: rawhide
Status: NEW
Whiteboard: {"flaws": ["34fd208f-dfbf-4cc0-bb75-85100ab66f0c"]}
Component: perl-HTML-FormHandler
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected], [email protected]
Blocks: 2530096 (CVE-2026-85484)
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
HTML::FormHandler versions before 0.410002 for Perl render option group labels
and radio button labels into HTML without escaping.
The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a
group label unescaped, Select into a label attribute and the other three into
element content. RadioGroup also renders each radio button's own label
unescaped.
Any application whose option list is built from data rather than literals,
using options_from, an options_fieldname method, or the DBIC model, allows
attacker-influenced text in a label that can override the options or embed
JavaScript in rendered pages.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2530096
[Bug 2530096] CVE-2026-85484 perl-HTML-FormHandler: HTML::FormHandler:
Cross-Site Scripting (XSS) via unescaped HTML labels
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2533728
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202533728%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
