CVE-2026-19872

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-19872
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19872.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-19872
Downstream
Published
2026-09-08T20:08:21Z
Modified
2026-09-10T03:45:45Z
Summary
HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message
Details

HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message.

The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages, no_match and not_allowed, splice the submitted value into that string, and a failing type constraint puts the rejected value into the message it builds, which _apply_actions hands to add_error.

A field declared with a check regexp, a check list or a type constraint reaches those messages, with no custom validator and no non-default configuration. Errors rendered through an application's own escaping template layer rather than the library's rendering roles are not affected.

A request over the network that submits markup to such a field gets it back live inside the error span, running script in the victim's origin. Re-rendering a rejected value later gives the stored variant.

Database specific 
{
    "cna_assigner": "CPANSec",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19872.json"
}
References

Affected packages

Git / github.com/gshank/html-formhandler

Affected ranges

Type
GIT
Repo
https://github.com/gshank/html-formhandler
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4aa24166e3a5cdbc3b64aa8a63c9d4ca8c529f34
Fixed
2574fdb4561f5c32d44cfbfbb3188345d49eb5a2
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.410000"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.22
0.23
0.27
0.27002
0.27003
0.31003
0.33001
0.33002
0.34000
0.34001
0.35000
0.35001
0.35002
0.35003
0.35005
0.36000
0.36001
0.40000
0.40001
0.40002
0.40003
0.40004
0.40005
0.40006
0.40007
0.40008
0.40009
0.40010
0.40011
0.40012
0.40013
0.40014
0.40015
0.40016
0.40017
0.40018
0.40019
0.40020
0.40021
0.40022
0.40023
0.40024
0.40025
0.40026
0.40027
0.40028
0.40050
0.40051
0.40052
0.40053
0.40054
0.40055
0.40056
0.40057
0.40058
0.40059
0.40060
0.40061
0.40062
0.40063
0.40064
0.40065
0.40066
0.40067
0.40068
Other
after-persist
dup_fields_order
empty-row
has_field
inherit_has_fields
roles
ver08
ver09
ver10
ver12
ver13
ver15
ver17+
ver-0.*
ver-0.20

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19872.json"