{"id":"CVE-2026-85630","title":"HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method.\n\nAny application with fields or field labels where some attributes are built from data rather than lit…","summary":"HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method.\n\nAny application with fields or field labels where some attributes are built from data rather than lit…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"Red Hat","product":"HTML-FormHandler","affected":["HTML-FormHandler < 0.410002"],"published":"2026-09-08","updated":"2026-09-10","sourceUpdated":"2026-09-10T18:18:09.860","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85630","references":[{"url":"https://github.com/gshank/html-formhandler/commit/a887271e91d755e6486a9f433ae932deb1d2c4a6.patch","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/ABRAXXA/HTML-FormHandler-0.410002/changes","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/08/18","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85630.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-85630"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85630"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-10T17:48:09.876823Z"},"epss":0.00255,"epssPercentile":0.17344,"scores":{"nvd":6.1,"vendor":5.4,"adp":6.1},"ingestedAt":"2026-09-08T21:11:12.320Z","slug":"CVE-2026-85630","body":"## Overview\n\nHTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method.\n\nAny application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value that can override the field attributes or embed JavaScript in rendered pages.\n\nFor example, the RadioGroup widget uses the process_attrs method via the render_option and wrap_radio methods.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85630.json)","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":202050,"id":"CVE-2026-85630","ts":1789400046985,"field":"cvss","old":null,"new":"6.1"},{"seq":202049,"id":"CVE-2026-85630","ts":1789400046985,"field":"severity","old":"none","new":"medium"},{"seq":200777,"id":"CVE-2026-85630","ts":1789397615461,"field":"cvss","old":"6.1","new":null},{"seq":200776,"id":"CVE-2026-85630","ts":1789397615461,"field":"severity","old":"medium","new":"none"},{"seq":199470,"id":"CVE-2026-85630","ts":1789395514579,"field":"cvss","old":null,"new":"6.1"},{"seq":199469,"id":"CVE-2026-85630","ts":1789395514579,"field":"severity","old":"none","new":"medium"},{"seq":198715,"id":"CVE-2026-85630","ts":1789392243028,"field":"cvss","old":"6.1","new":null},{"seq":198714,"id":"CVE-2026-85630","ts":1789392243028,"field":"severity","old":"medium","new":"none"},{"seq":197048,"id":"CVE-2026-85630","ts":1789384291391,"field":"cvss","old":null,"new":"6.1"},{"seq":197047,"id":"CVE-2026-85630","ts":1789384291391,"field":"severity","old":"none","new":"medium"},{"seq":194177,"id":"CVE-2026-85630","ts":1789378782141,"field":"cvss","old":"6.1","new":null},{"seq":194176,"id":"CVE-2026-85630","ts":1789378782141,"field":"severity","old":"medium","new":"none"},{"seq":192964,"id":"CVE-2026-85630","ts":1789376514003,"field":"cvss","old":null,"new":"6.1"},{"seq":192963,"id":"CVE-2026-85630","ts":1789376514003,"field":"severity","old":"none","new":"medium"},{"seq":191751,"id":"CVE-2026-85630","ts":1789373630159,"field":"cvss","old":"6.1","new":null},{"seq":191750,"id":"CVE-2026-85630","ts":1789373630159,"field":"severity","old":"medium","new":"none"},{"seq":190536,"id":"CVE-2026-85630","ts":1789369473006,"field":"cvss","old":null,"new":"6.1"},{"seq":190535,"id":"CVE-2026-85630","ts":1789369473006,"field":"severity","old":"none","new":"medium"},{"seq":189323,"id":"CVE-2026-85630","ts":1789368408070,"field":"cvss","old":"6.1","new":null},{"seq":189322,"id":"CVE-2026-85630","ts":1789368408070,"field":"severity","old":"medium","new":"none"},{"seq":188106,"id":"CVE-2026-85630","ts":1789365229625,"field":"cvss","old":null,"new":"6.1"},{"seq":188105,"id":"CVE-2026-85630","ts":1789365229625,"field":"severity","old":"none","new":"medium"},{"seq":186893,"id":"CVE-2026-85630","ts":1789363470355,"field":"cvss","old":"6.1","new":null},{"seq":186892,"id":"CVE-2026-85630","ts":1789363470355,"field":"severity","old":"medium","new":"none"},{"seq":185679,"id":"CVE-2026-85630","ts":1789361227925,"field":"cvss","old":null,"new":"6.1"},{"seq":185678,"id":"CVE-2026-85630","ts":1789361227925,"field":"severity","old":"none","new":"medium"},{"seq":184466,"id":"CVE-2026-85630","ts":1789358362696,"field":"cvss","old":"6.1","new":null},{"seq":184465,"id":"CVE-2026-85630","ts":1789358362696,"field":"severity","old":"medium","new":"none"},{"seq":182717,"id":"CVE-2026-85630","ts":1789354316025,"field":"cvss","old":null,"new":"6.1"},{"seq":182716,"id":"CVE-2026-85630","ts":1789354316025,"field":"severity","old":"none","new":"medium"},{"seq":181510,"id":"CVE-2026-85630","ts":1789353316751,"field":"cvss","old":"6.1","new":null},{"seq":181509,"id":"CVE-2026-85630","ts":1789353316751,"field":"severity","old":"medium","new":"none"},{"seq":180303,"id":"CVE-2026-85630","ts":1789350283664,"field":"cvss","old":null,"new":"6.1"},{"seq":180302,"id":"CVE-2026-85630","ts":1789350283664,"field":"severity","old":"none","new":"medium"},{"seq":179096,"id":"CVE-2026-85630","ts":1789348291929,"field":"cvss","old":"6.1","new":null},{"seq":179095,"id":"CVE-2026-85630","ts":1789348291929,"field":"severity","old":"medium","new":"none"},{"seq":177889,"id":"CVE-2026-85630","ts":1789346368960,"field":"cvss","old":null,"new":"6.1"},{"seq":177888,"id":"CVE-2026-85630","ts":1789346368960,"field":"severity","old":"none","new":"medium"},{"seq":176682,"id":"CVE-2026-85630","ts":1789343183580,"field":"cvss","old":"6.1","new":null},{"seq":176681,"id":"CVE-2026-85630","ts":1789343183580,"field":"severity","old":"medium","new":"none"},{"seq":174799,"id":"CVE-2026-85630","ts":1789334874593,"field":"cvss","old":null,"new":"6.1"},{"seq":174798,"id":"CVE-2026-85630","ts":1789334874593,"field":"severity","old":"none","new":"medium"},{"seq":173594,"id":"CVE-2026-85630","ts":1789333685837,"field":"cvss","old":"6.1","new":null},{"seq":173593,"id":"CVE-2026-85630","ts":1789333685837,"field":"severity","old":"medium","new":"none"},{"seq":172408,"id":"CVE-2026-85630","ts":1789331091956,"field":"cvss","old":null,"new":"6.1"},{"seq":172407,"id":"CVE-2026-85630","ts":1789331091956,"field":"severity","old":"none","new":"medium"},{"seq":171222,"id":"CVE-2026-85630","ts":1789328779934,"field":"cvss","old":"6.1","new":null},{"seq":171221,"id":"CVE-2026-85630","ts":1789328779934,"field":"severity","old":"medium","new":"none"},{"seq":170017,"id":"CVE-2026-85630","ts":1789327196097,"field":"cvss","old":null,"new":"6.1"},{"seq":170016,"id":"CVE-2026-85630","ts":1789327196097,"field":"severity","old":"none","new":"medium"}]}