CVE-2026-13051

Name of the Vulnerable Software and Affected Versions Form::Processor::Field::HtmlArea versions 0.06 through 1.162360

Description An issue exists where the validate() function processes submitted markup using HTML::Tidy and passes the resulting messages to the add error() function. These messages are then used as Locale::Maketext message keys. Because the default handle uses AUTO, messages not found in the lexicon are compiled as bracket notation templates. An attacker can submit crafted markup containing bracket groups that allow them to call methods on the language handle with arbitrary arguments. This can lead to unhandled exceptions, resource exhaustion through excessive memory allocation via CORE::sprintf(), or the execution of side-effecting public methods defined in the language handle subclass.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.