{"id":"CVE-2026-19872","title":"HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message.\n\nThe wrappers and renderers that emit a form's errors interpolate the error string straight into…","summary":"HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message.\n\nThe wrappers and renderers that emit a form's errors interpolate the error string straight into…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"product":"HTML-FormHandler","affected":["HTML-FormHandler < 0.410000"],"published":"2026-09-08","updated":"2026-09-10","sourceUpdated":"2026-09-10T18:17:58.827","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19872","references":[{"url":"https://github.com/gshank/html-formhandler/commit/2574fdb4561f5c32d44cfbfbb3188345d49eb5a2.patch","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/ABRAXXA/HTML-FormHandler-0.410000/changes","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/08/15","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19872.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-19872"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19872"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-10T17:51:07.811981Z"},"epss":0.00327,"epssPercentile":0.26034,"ingestedAt":"2026-09-08T21:11:12.314Z","vendor":"Red Hat","scores":{"nvd":6.1,"vendor":5.4},"slug":"CVE-2026-19872","body":"## Overview\n\nHTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message.\n\nThe wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages, no_match and not_allowed, splice the submitted value into that string, and a failing type constraint puts the rejected value into the message it builds, which _apply_actions hands to add_error.\n\nA field declared with a check regexp, a check list or a type constraint reaches those messages, with no custom validator and no non-default configuration. Errors rendered through an application's own escaping template layer rather than the library's rendering roles are not affected.\n\nA request over the network that submits markup to such a field gets it back live inside the error span, running script in the victim's origin. Re-rendering a rejected value later gives the stored variant.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19872.json)","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201469,"id":"CVE-2026-19872","ts":1789399483370,"field":"cvss","old":null,"new":"6.1"},{"seq":201468,"id":"CVE-2026-19872","ts":1789399483370,"field":"severity","old":"none","new":"medium"},{"seq":200203,"id":"CVE-2026-19872","ts":1789397013507,"field":"cvss","old":"6.1","new":null},{"seq":200202,"id":"CVE-2026-19872","ts":1789397013507,"field":"severity","old":"medium","new":"none"},{"seq":198127,"id":"CVE-2026-19872","ts":1789391706375,"field":"cvss","old":null,"new":"6.1"},{"seq":198126,"id":"CVE-2026-19872","ts":1789391706375,"field":"severity","old":"none","new":"medium"},{"seq":195920,"id":"CVE-2026-19872","ts":1789383360041,"field":"cvss","old":"6.1","new":null},{"seq":195919,"id":"CVE-2026-19872","ts":1789383360041,"field":"severity","old":"medium","new":"none"},{"seq":194849,"id":"CVE-2026-19872","ts":1789380285898,"field":"cvss","old":null,"new":"6.1"},{"seq":194848,"id":"CVE-2026-19872","ts":1789380285898,"field":"severity","old":"none","new":"medium"},{"seq":193636,"id":"CVE-2026-19872","ts":1789378224971,"field":"cvss","old":"6.1","new":null},{"seq":193635,"id":"CVE-2026-19872","ts":1789378224971,"field":"severity","old":"medium","new":"none"},{"seq":192423,"id":"CVE-2026-19872","ts":1789376207688,"field":"cvss","old":null,"new":"6.1"},{"seq":192422,"id":"CVE-2026-19872","ts":1789376207688,"field":"severity","old":"none","new":"medium"},{"seq":191210,"id":"CVE-2026-19872","ts":1789373084616,"field":"cvss","old":"6.1","new":null},{"seq":191209,"id":"CVE-2026-19872","ts":1789373084616,"field":"severity","old":"medium","new":"none"},{"seq":189995,"id":"CVE-2026-19872","ts":1789369107539,"field":"cvss","old":null,"new":"6.1"},{"seq":189994,"id":"CVE-2026-19872","ts":1789369107539,"field":"severity","old":"none","new":"medium"},{"seq":188782,"id":"CVE-2026-19872","ts":1789368013654,"field":"cvss","old":"6.1","new":null},{"seq":188781,"id":"CVE-2026-19872","ts":1789368013654,"field":"severity","old":"medium","new":"none"},{"seq":187565,"id":"CVE-2026-19872","ts":1789364978603,"field":"cvss","old":null,"new":"6.1"},{"seq":187564,"id":"CVE-2026-19872","ts":1789364978603,"field":"severity","old":"none","new":"medium"},{"seq":186352,"id":"CVE-2026-19872","ts":1789362962403,"field":"cvss","old":"6.1","new":null},{"seq":186351,"id":"CVE-2026-19872","ts":1789362962403,"field":"severity","old":"medium","new":"none"},{"seq":185138,"id":"CVE-2026-19872","ts":1789360950532,"field":"cvss","old":null,"new":"6.1"},{"seq":185137,"id":"CVE-2026-19872","ts":1789360950532,"field":"severity","old":"none","new":"medium"},{"seq":183925,"id":"CVE-2026-19872","ts":1789357888680,"field":"cvss","old":"6.1","new":null},{"seq":183924,"id":"CVE-2026-19872","ts":1789357888680,"field":"severity","old":"medium","new":"none"},{"seq":182177,"id":"CVE-2026-19872","ts":1789354074437,"field":"cvss","old":null,"new":"6.1"},{"seq":182176,"id":"CVE-2026-19872","ts":1789354074437,"field":"severity","old":"none","new":"medium"},{"seq":180970,"id":"CVE-2026-19872","ts":1789352911905,"field":"cvss","old":"6.1","new":null},{"seq":180969,"id":"CVE-2026-19872","ts":1789352911905,"field":"severity","old":"medium","new":"none"},{"seq":179763,"id":"CVE-2026-19872","ts":1789349973247,"field":"cvss","old":null,"new":"6.1"},{"seq":179762,"id":"CVE-2026-19872","ts":1789349973247,"field":"severity","old":"none","new":"medium"},{"seq":178556,"id":"CVE-2026-19872","ts":1789347766719,"field":"cvss","old":"6.1","new":null},{"seq":178555,"id":"CVE-2026-19872","ts":1789347766719,"field":"severity","old":"medium","new":"none"},{"seq":177349,"id":"CVE-2026-19872","ts":1789346156787,"field":"cvss","old":null,"new":"6.1"},{"seq":177348,"id":"CVE-2026-19872","ts":1789346156787,"field":"severity","old":"none","new":"medium"},{"seq":176142,"id":"CVE-2026-19872","ts":1789342701422,"field":"cvss","old":"6.1","new":null},{"seq":176141,"id":"CVE-2026-19872","ts":1789342701422,"field":"severity","old":"medium","new":"none"},{"seq":175926,"id":"CVE-2026-19872","ts":1789342311788,"field":"cvss","old":null,"new":"6.1"},{"seq":175925,"id":"CVE-2026-19872","ts":1789342311788,"field":"severity","old":"none","new":"medium"},{"seq":175466,"id":"CVE-2026-19872","ts":1789338355033,"field":"cvss","old":"6.1","new":null},{"seq":175465,"id":"CVE-2026-19872","ts":1789338355033,"field":"severity","old":"medium","new":"none"},{"seq":174261,"id":"CVE-2026-19872","ts":1789334577060,"field":"cvss","old":null,"new":"6.1"},{"seq":174260,"id":"CVE-2026-19872","ts":1789334577060,"field":"severity","old":"none","new":"medium"},{"seq":173056,"id":"CVE-2026-19872","ts":1789333178722,"field":"cvss","old":"6.1","new":null},{"seq":173055,"id":"CVE-2026-19872","ts":1789333178722,"field":"severity","old":"medium","new":"none"},{"seq":171870,"id":"CVE-2026-19872","ts":1789330866157,"field":"cvss","old":null,"new":"6.1"},{"seq":171869,"id":"CVE-2026-19872","ts":1789330866157,"field":"severity","old":"none","new":"medium"}]}