EUVD-2026-74167
GHSA-mwmv-8rm6-755x
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered XSS with scope change; attacker needs no auth but victim must load the affected form page.
Primary rating from Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e).
CVSS VectorVendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Lifecycle Timeline
4DescriptionCVE.org
HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping.
The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, Select into a label attribute and the other three into element content. RadioGroup also renders each radio button's own label unescaped.
Any application whose option list is built from data rather than literals, using options_from, an options_fieldname method, or the DBIC model, allows attacker-influenced text in a label that can override the options or embed JavaScript in rendered pages.
AnalysisAI
Stored and reflected cross-site scripting in HTML::FormHandler before 0.410002 (Perl/CPAN) allows attacker-influenced text in form option labels to execute arbitrary JavaScript in victims' browsers. The Select, RadioGroup, CheckboxGroup, and HorizCheckboxGroup widgets passed group labels and individual option labels directly into rendered HTML without applying HTML encoding, meaning any application that builds option lists from database records, user submissions, or dynamic sources exposes those label values as live markup. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the application constructs its option list from data rather than hardcoded literals - specifically by using `options_from`, a per-field `options_<fieldname>` method, or the DBIC model integration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.1 score (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is consistent with a classic reflected or stored XSS: network-reachable, low complexity, no authentication required on the attacker side, but requiring a victim to load the affected page. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade HTML::FormHandler to version 0.410002 or later, which wraps all affected label interpolations with `$self->html_filter()` across the four widget modules. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today