{
  "cveId": "CVE-2026-19872",
  "url": "https://patchblox.com/security/cve/CVE-2026-19872",
  "summary": "CVE-2026-19872 is fixed in libhtml-formhandler-perl on 1 platform by DEBIAN-CVE-2026-19872 (version 0.410002-1), released September 17, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "libhtml-formhandler-perl: HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescap...",
  "description": "HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message.  The wrappers and renderers that emit a form\u0027s errors interpolate the error string straight into HTML with no escaping. Two of the library\u0027s own messages, no_match and not_allowed, splice the submitted value into that string, and a failing type constraint puts the rejected value into the message it builds, which _apply_actions hands to add_error.  A field declared with a check regexp, a check list or a type constraint reaches those messages, with no custom validator and no non-default configuration. Errors rendered through an application\u0027s own escaping template layer rather than the library\u0027s rendering roles are not affected.  A request over the network that submits markup to such a field gets it back live inside the error span, running script in the victim\u0027s origin. Re-rendering a rejected value later gives the stored variant.",
  "published": "2026-09-08T20:17:29Z",
  "severity": "medium",
  "cvss": 6.1,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "epss": 0.00327,
  "epssPercentile": 0.25956,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libhtml-formhandler-perl",
      "release": "Debian 14",
      "fixedVersion": "0.410002-1",
      "fix": "DEBIAN-CVE-2026-19872",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-19872",
      "released": "2026-09-17T18:08:56Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}