CVE-2026-85630

HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process attrs method.

Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value that can override the field attributes or embed JavaScript in rendered pages.

For example, the RadioGroup widget uses the process attrs method via the render option and wrap radio methods.