[From nobody Fri Sep 11 17:09:06 2026 Received: (at submit) by bugs.debian.org; 9 Sep 2026 07:36:56 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-9.9 required=4.0 tests=BAYES_00, FOURLA, FROMDEVELOPER, NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 45; hammy, 150; neutral, 115; spammy, 0. spammytokens: hammytokens:0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--H*F:U*carnil, 0.000-+--H*Ad:N*Bug, 0.000-+--HTo:N*Debian Return-path: <carnil@debian.org> Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96) (envelope-from <carnil@debian.org>) id 1x4CrW-00CUtS-1W for submit@bugs.debian.org; Wed, 09 Sep 2026 07:36:56 +0000 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: libhtml-formhandler-perl: CVE-2026-19872 CVE-2026-85484 CVE-2026-85485 CVE-2026-85630 Message-ID: <178893941136.2568092.1542681925803144381.reportbug@elende.valinor.li> X-Mailer: reportbug 13.2.0+nmu1 Date: Wed, 09 Sep 2026 09:36:51 +0200 Delivered-To: submit@bugs.debian.org Source: libhtml-formhandler-perl Version: 0.40068-1 Severity: important Tags: security upstream X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org> Hi, The following vulnerabilities were published for libhtml-formhandler-perl. CVE-2026-19872[0]: | HTML::FormHandler versions before 0.410000 for Perl allow cross-site | scripting via a submitted value rendered unescaped in an error | message. The wrappers and renderers that emit a form's errors | interpolate the error string straight into HTML with no escaping. | Two of the library's own messages, no_match and not_allowed, splice | the submitted value into that string, and a failing type constraint | puts the rejected value into the message it builds, which | _apply_actions hands to add_error. A field declared with a check | regexp, a check list or a type constraint reaches those messages, | with no custom validator and no non-default configuration. Errors | rendered through an application's own escaping template layer rather | than the library's rendering roles are not affected. A request over | the network that submits markup to such a field gets it back live | inside the error span, running script in the victim's origin. Re- | rendering a rejected value later gives the stored variant. CVE-2026-85484[1]: | HTML::FormHandler versions before 0.410002 for Perl render option | group labels and radio button labels into HTML without escaping. | The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets | render a group label unescaped, Select into a label attribute and | the other three into element content. RadioGroup also renders each | radio button's own label unescaped. Any application whose option | list is built from data rather than literals, using options_from, an | options_fieldname method, or the DBIC model, allows attacker- | influenced text in a label that can override the options or embed | JavaScript in rendered pages. CVE-2026-85485[2]: | HTML::FormHandler versions before 0.410002 for Perl render some error | messages into HTML without escaping. The Table form layout and the | Bootstrap 2 and 3 wrappers splice each error string straight into the | surrounding markup. Version 0.410000, the fix for CVE-2026-19872, | escaped the equivalent values in the other layouts and wrappers, and | 0.410002 extended that to these three. Error messages that contain attacker- | influenced content such as rejected field values could embed | JavaScript in rendered pages. CVE-2026-85630[3]: | HTML::FormHandler versions before 0.410002 for Perl render field | attributes into HTML without escaping using the process_attrs | method. Any application with fields or field labels where some | attributes are built from data rather than literals allows attacker- | influenced text in an attribute value that can override the field | attributes or embed JavaScript in rendered pages. For example, the | RadioGroup widget uses the process_attrs method via the | render_option and wrap_radio methods. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-19872 https://www.cve.org/CVERecord?id=CVE-2026-19872 [1] https://security-tracker.debian.org/tracker/CVE-2026-85484 https://www.cve.org/CVERecord?id=CVE-2026-85484 [2] https://security-tracker.debian.org/tracker/CVE-2026-85485 https://www.cve.org/CVERecord?id=CVE-2026-85485 [3] https://security-tracker.debian.org/tracker/CVE-2026-85630 https://www.cve.org/CVERecord?id=CVE-2026-85630 Regards, Salvatore ]