Debian/libhtml-formhandler-perl: medium 6.1
HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping. The Table form layout and the Bootstrap 2 and 3 wrappers splice each error string straight in
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: DEBIAN-CVE-2026-85485#Debian:13/libhtml-formhandler-perl
- https://security-tracker.debian.org/tracker/CVE-2026-85485
published · modified · JSON