Bug#1147198: libhtml-formhandler-perl: CVE-2026-19872 CVE-2026-85484 CVE-2026-85485 CVE-2026-85630

[Salvatore Bonaccorso]

Source: libhtml-formhandler-perl
Version: 0.40068-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerabilities were published for libhtml-formhandler-perl.

CVE-2026-19872[0]:
| HTML::FormHandler versions before 0.410000 for Perl allow cross-site
| scripting via a submitted value rendered unescaped in an error
| message.  The wrappers and renderers that emit a form's errors
| interpolate the error string straight into HTML with no escaping.
| Two of the library's own messages, no_match and not_allowed, splice
| the submitted value into that string, and a failing type constraint
| puts the rejected value into the message it builds, which
| _apply_actions hands to add_error.  A field declared with a check
| regexp, a check list or a type constraint reaches those messages,
| with no custom validator and no non-default configuration. Errors
| rendered through an application's own escaping template layer rather
| than the library's rendering roles are not affected.  A request over
| the network that submits markup to such a field gets it back live
| inside the error span, running script in the victim's origin. Re-
| rendering a rejected value later gives the stored variant.


CVE-2026-85484[1]:
| HTML::FormHandler versions before 0.410002 for Perl render option
| group labels and radio button labels into HTML without escaping.
| The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets
| render a group label unescaped, Select into a label attribute and
| the other three into element content. RadioGroup also renders each
| radio button's own label unescaped.  Any application whose option
| list is built from data rather than literals, using options_from, an
| options_fieldname method, or the DBIC model, allows attacker-
| influenced text in a label that can override the options or embed
| JavaScript in rendered pages.


CVE-2026-85485[2]:
| HTML::FormHandler versions before 0.410002 for Perl render some error
| messages into HTML without escaping. The Table form layout and the
| Bootstrap 2 and 3 wrappers splice each error string straight into the
| surrounding markup. Version 0.410000, the fix for CVE-2026-19872,
| escaped the equivalent values in the other layouts and wrappers, and
| 0.410002 extended that to these three. Error messages that contain attacker-
| influenced content such as rejected field values could embed
| JavaScript in rendered pages.


CVE-2026-85630[3]:
| HTML::FormHandler versions before 0.410002 for Perl render field
| attributes into HTML without escaping using the process_attrs
| method.  Any application with fields or field labels where some
| attributes are built from data rather than literals allows attacker-
| influenced text in an attribute value that can override the field
| attributes or embed JavaScript in rendered pages.  For example, the
| RadioGroup widget uses the process_attrs method via the
| render_option and wrap_radio methods.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-19872
    https://www.cve.org/CVERecord?id=CVE-2026-19872
[1] https://security-tracker.debian.org/tracker/CVE-2026-85484
    https://www.cve.org/CVERecord?id=CVE-2026-85484
[2] https://security-tracker.debian.org/tracker/CVE-2026-85485
    https://www.cve.org/CVERecord?id=CVE-2026-85485
[3] https://security-tracker.debian.org/tracker/CVE-2026-85630
    https://www.cve.org/CVERecord?id=CVE-2026-85630

Regards,
Salvatore