EUVD-2026-74170
GHSA-4qf4-6x5x-m29p
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network XSS requiring victim page load (UI:R); scope changes to browser context (S:C); no auth needed; C and I limited to partial session/content impact.
Primary rating from Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e).
CVSS VectorVendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Lifecycle Timeline
4DescriptionCVE.org
HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method.
Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value that can override the field attributes or embed JavaScript in rendered pages.
For example, the RadioGroup widget uses the process_attrs method via the render_option and wrap_radio methods.
AnalysisAI
Cross-site scripting in HTML::FormHandler before 0.410002 for Perl allows unauthenticated remote attackers to inject JavaScript into rendered pages when application field attributes are derived from user-controlled data. The root cause is the process_attrs method in HTML/FormHandler/Render/Util.pm, which formats attribute key-value pairs via sprintf('%s="%s"', $attr, $value) without encoding, letting a double-quote character break out of the attribute context and inject event handlers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two conditions must both be true for exploitation: (1) the application uses HTML::FormHandler before version 0.410002; and (2) at least one form field has one or more HTML attributes whose values are derived from non-literal data - specifically user-submitted input, URL parameters, or database-stored content passed into field attribute hashes at render time. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.1 base score with S:C reflects a classic reflected or stored XSS pattern where the impact escapes the application into the browser security context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade HTML::FormHandler to version 0.410002 or later via CPAN (`cpanm HTML::FormHandler` or `cpan install HTML::FormHandler`). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today