HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method.
Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value that can override the field attributes or embed JavaScript in rendered pages.
For example, the RadioGroup widget uses the process_attrs method via the render_option and wrap_radio methods.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
Required
User action required
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 3
https://github.com/gshank/html-formhandler/commit/a887271e91d755e6486a9f433ae93…
9b29abf9-4ab0-4765-b253-1875cd9b441e
https://metacpan.org/release/ABRAXXA/HTML-FormHandler-0.410002/changes
9b29abf9-4ab0-4765-b253-1875cd9b441e
http://www.openwall.com/lists/oss-security/2026/09/08/18
af854a3a-2127-422b-91ae-364da2661108