CVE-2026-13051

The CVSS 9.1 score for CVE-2026-13051 overstates the practical risk because it aggregates two distinct attack scenarios with fundamentally different exploitability conditions. The vulnerability lives in Form::Processor's integration with Locale::Maketext's _AUTO feature, which compiles unrecognized bracket tokens as method calls rather than treating them as inert strings. When Tidy diagnostic messages pass through add_error, attacker-controlled attribute values like those in `<img src="[0]">` become executable templates. The first attack vector is denial-of-service. Triggering an unhandled exception via malformed tokens or exhausting memory with sprintf field widths (sprintf("%999999999s", "")) works against any deployment regardless of application design. This is the reliable, universally exploitable path — and it's the one that likely represents the actual operational risk for most users. The second vector is arbitrary method invocation on the language handle. This only becomes exploitable as code execution if the application's language handle subclass defines side-effecting public methods. Most deployments probably don't, which means the code execution risk is application-dependent rather than inherent to the library. The CVSS 9.1 conflates this worst-case scenario with the baseline. What matters for defenders: Check whether your language handle subclass exposes any public methods with side effects — logging, email, database operations, or state mutation. If it does, treat this as code execution risk. If not, the practical severity is DoS-only. Regardless, the sprintf memory exhaustion path requires no application-specific conditions and should be prioritized in mitigation. The fix should either sanitize Tidy diagnostics before they reach add_error, disable _AUTO compilation, or both. Historical pattern suggests patches often target the specific injection vector without addressing _AUTO's architectural role — monitor for whether your dependency updates actually resolve the root cause or merely close this specific path while leaving the mechanism intact.

Reviewed through automated stages and approved by a human before publication.