HTML Rendering Vulnerability in Data::MuForm for Perl

CVE-2026-121632

What is CVE-2026-121632?

Data::MuForm versions up to 0.05 for Perl have a significant issue where attribute values and option labels are rendered into HTML without proper escaping. Specifically, the process_attrs function outputs each attribute value directly into the markup, leading to scenarios where attacker-controlled text can be embedded within JavaScript on rendered pages. This is particularly concerning for applications that dynamically build option lists from data sources, as it opens pathways for JavaScript injection through rendering methods that utilize user-influenced data.

References