Form::Processor CVE-2026-13051

The application must expose a Form::Processor form containing an HtmlArea field type (versions 0.06 through 1.162360) that is reachable by the attacker, and the field's validate must run HTML::Tidy over submitted markup and hand diagnostics to add_error - this is the default HtmlArea behavior. The default language handle sets the _AUTO lexicon flag, which is what causes unknown keys to be compiled as templates; if the deployment has disabled _AUTO or does not use the default handle, the template-compilation path does not trigger. Denial of service (unhandled croak or memory exhaustion) works against default configurations with no authentication or user interaction. Escalation to attacker-controlled method side effects additionally requires that the application's Locale::Maketext handle subclass define side-effecting public methods callable by name - an application-specific, non-default condition that limits the confidentiality/integrity impact. Only the HtmlArea field type is affected; forms using other field types are not exploitable.

The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) rates network-reachable, low-complexity, unauthenticated exploitation with high confidentiality and integrity impact but explicitly no availability impact - which conflicts with the description, since the most reliable and default-configuration outcome is availability loss (unhandled croak from a group like [0], or memory exhaustion from [sprintf,%2000000000d,7]). The claimed C:H/I:H impact is conditional: arbitrary method dispatch only causes confidentiality/integrity damage if the deployed application's language-handle subclass defines side-effecting public methods, which is non-default. EPSS is low (0.40%, 33rd percentile) and the product is a niche legacy CPAN module, so widespread automated exploitation is unlikely despite the high CVSS. Net: a genuine, easily-triggered denial-of-service against default deployments, escalating to method-dispatch abuse only in applications with vulnerable handle subclasses - verify the actual impact ceiling against the specific application rather than assuming worst-case RCE-style C:H/I:H.

An attacker submits a web form containing an HtmlArea field with markup whose attribute value embeds a Maketext bracket group - for example an element whose attribute is set to [sprintf,%2000000000d,7]. HTML::Tidy flags the malformed attribute, its diagnostic quotes the attacker payload, and add_error compiles it as a template, driving CORE::sprintf to allocate a huge field width and exhaust process memory; a payload like [0] instead throws an unhandled exception out of form validation. No public exploit code is identified at time of analysis, but the single-request, unauthenticated, low-complexity nature makes weaponization straightforward.