Upstream information

CVE-2026-85630 at MITRE

Description

HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method.

Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value that can override the field attributes or embed JavaScript in rendered pages.

For example, the RadioGroup widget uses the process_attrs method via the render_option and wrap_radio methods.

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having moderate severity.

SUSE Bugzilla entry: 1279871 [NEW]

No SUSE Security Announcements cross referenced.

SUSE Timeline for this CVE

CVE page created: Wed Sep 9 15:50:40 2026
CVE page last modified: Wed Sep 9 15:50:40 2026