Bug 2530531 - CVE-2026-85630 perl-HTML-FormHandler: perl-HTML-FormHandler: Cross-site Scripting vulnerability via unescaped HTML field attributes [fedora-all]
Summary: CVE-2026-85630 perl-HTML-FormHandler: perl-HTML-FormHandler: Cross-site Scrip...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: perl-HTML-FormHandler
Version: rawhide
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Emmanuel Seyman
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["44042f27-9b4c-4c7b-815c-1...
Depends On:
Blocks: CVE-2026-85630
TreeView+ depends on / blocked
 
Reported: 2026-09-09 07:04 UTC by Vladimir Vasilev
Modified: 2026-09-22 01:14 UTC (History)
2 users (show)

Fixed In Version: perl-HTML-FormHandler-0.410002-1.fc45 perl-HTML-FormHandler-0.410002-1.fc44 perl-HTML-FormHandler-0.410002-1.fc43
Clone Of:
Environment:
Last Closed: 2026-09-22 00:17:44 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Vladimir Vasilev 2026-09-09 07:04:34 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method.

Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value that can override the field attributes or embed JavaScript in rendered pages.

For example, the RadioGroup widget uses the process_attrs method via the render_option and wrap_radio methods.

Comment 1 Fedora Update System 2026-09-13 10:07:10 UTC
FEDORA-2026-406a152d49 (perl-HTML-FormHandler-0.410002-1.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-406a152d49

Comment 2 Fedora Update System 2026-09-13 10:07:11 UTC
FEDORA-2026-21850d7df0 (perl-HTML-FormHandler-0.410002-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-21850d7df0

Comment 3 Fedora Update System 2026-09-13 10:07:12 UTC
FEDORA-2026-167a356523 (perl-HTML-FormHandler-0.410002-1.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-167a356523

Comment 4 Fedora Update System 2026-09-14 01:29:34 UTC
FEDORA-2026-406a152d49 has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-406a152d49`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-406a152d49

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2026-09-14 01:35:17 UTC
FEDORA-2026-167a356523 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-167a356523`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-167a356523

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2026-09-14 02:04:46 UTC
FEDORA-2026-21850d7df0 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-21850d7df0`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-21850d7df0

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2026-09-22 00:17:44 UTC
FEDORA-2026-406a152d49 (perl-HTML-FormHandler-0.410002-1.fc45) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 8 Fedora Update System 2026-09-22 00:53:52 UTC
FEDORA-2026-21850d7df0 (perl-HTML-FormHandler-0.410002-1.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 9 Fedora Update System 2026-09-22 01:14:20 UTC
FEDORA-2026-167a356523 (perl-HTML-FormHandler-0.410002-1.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.