CVE-2026-121632: Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping
Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping.
processattrs writes each attribute value into the markup as is. The select, radio group and checkbox group renderers pass each option to it, so an option's value becomes an unescaped attribute. Option and option group labels are also unescaped, the group label inside a label attribute and the others in element content.
Any application whose option list is built from data rather than literals, using an options<fieldname> method, a buildoptions method or a DBIC model, allows attacker-influenced text in an option value or label that can embed JavaScript in rendered pages. Attribute values built from data, such as through elementattr, are affected the same way.
Event History
Frequently Asked Questions
Which applications are realistically exposed?
Applications are exposed when they render forms with attacker-influenced option values or labels, or attacker-influenced attribute values. This includes option lists populated through an options_<field_name> method, build_options, or a DBIC model rather than fixed literals.
What attacker-controlled data can trigger the issue?
An attacker needs to influence an option value, option label, option-group label, or an attribute value passed to the renderer. Option values are placed into HTML attributes without escaping; labels are rendered without escaping in element content or, for group labels, in a label attribute.
Are forms using only hard-coded option lists affected in the same way?
The described attack path depends on data rather than literals being used for option values or labels. Forms whose rendered attributes and options are fixed literals do not provide the attacker-influenced input described here.
How can I determine whether an application is affected?
Review uses of options_<field_name>, build_options, and DBIC-backed option generation, along with element_attr or other data-derived attributes. Determine whether any values or labels reaching those paths can contain user-controlled or externally sourced text.