EUVD-2026-74166
GHSA-74pj-vp7j-2f6m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network form submission requires no auth (PR:N); victim page load required (UI:R); XSS crosses browser security boundary (S:C); no availability impact.
Primary rating from Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e).
CVSS VectorVendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Lifecycle Timeline
4DescriptionCVE.org
HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message.
The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages, no_match and not_allowed, splice the submitted value into that string, and a failing type constraint puts the rejected value into the message it builds, which _apply_actions hands to add_error.
A field declared with a check regexp, a check list or a type constraint reaches those messages, with no custom validator and no non-default configuration. Errors rendered through an application's own escaping template layer rather than the library's rendering roles are not affected.
A request over the network that submits markup to such a field gets it back live inside the error span, running script in the victim's origin. Re-rendering a rejected value later gives the stored variant.
AnalysisAI
Cross-site scripting in HTML::FormHandler before 0.410000 (Perl/CPAN) allows unauthenticated network attackers to inject arbitrary JavaScript by submitting markup to any form field that triggers a validation error message embedding the submitted value. The library's rendering roles - Render::Simple, Render::Table, and Widget::Form::Simple - interpolate error strings directly into HTML error spans without entity encoding, so fields using check regexps, check lists, or type constraints expose the reflected XSS path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The application must use HTML::FormHandler before 0.410000 and must render error output through the library's own rendering roles (Render::Simple, Render::Table, or Widget::Form::Simple) rather than a custom template layer that independently escapes output. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.1 score with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N accurately reflects a classic reflected XSS profile: network-reachable with no authentication requirement, but dependent on a victim loading the page containing the error response. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to HTML::FormHandler 0.410000 or later via CPAN using `cpanm HTML::FormHandler` or `cpan HTML::FormHandler`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today