CVE-2022-4993

CVE-2022-4993 is a template injection vulnerability in HTML::FormHandler that stems from a fundamental design error: the library routes error messages containing user-submitted data through Locale::Maketext's bracket notation, which compiles any non-lexicon string as a template. This isn't a single code mistake — it's a categorization failure that manifested across at least four separate code paths in the library. The core problem is that HTML::FormHandler treats internally-generated error messages (from type constraint failures, coercion exceptions, or captured warnings) as if they occupy a trusted localization context. But Locale::Maketext has no concept of 'this string came from inside the house' — it treats everything that isn't a lexicon key as a template to compile. When a type constraint rejects user input, the rejection message gets routed through `add_error` or captured by warning handlers, then rendered through Maketext, allowing an attacker to inject Maketext bracket notation that gets executed as code. The attack surface is narrower than the CVSS 9.1 suggests. The vulnerability requires either a custom language handle subclass with methods accessible to the attacker, or a specific configuration that allows the memory exhaustion vector to trigger. Most applications using only the default language handle are partially protected because the dumper quotes non-numeric elements, preventing direct method name injection. However, any application with a custom language handle — common in applications requiring advanced localization — gains full method dispatch potential on that handle object, which may have access to templates, configuration, or session state. What you should check: identify any custom subclasses of Locale::Maketext::Handle in your application or dependencies, audit any methods on those handles that could manipulate application state, and review any field type definitions that use custom error message callbacks. The safe pattern is what the patch implements — field types register explicit message callbacks that bypass Maketext rendering entirely, rather than generating messages from data at runtime. If you have custom field types or validation handlers, ensure they follow this pattern. The EPSS score of 0.00365 likely reflects the specialized knowledge required to exploit this (understanding FormHandler's error aggregation, Moose's type system, and Maketext dispatch simultaneously) rather than genuine low risk for configured targets.

Reviewed through automated stages and approved by a human before publication.