CVE-2026-121632 · Package
NO FIX YET
Data::MuForm versions through 0.05 write option values, labels and attribute values into rendered HTML without escaping them. An attacker who controls option text built from data can inject JavaScript that runs in a victim's browser when the page is viewed.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Applications that use Data::MuForm up to and including 0.05 and build option lists or attribute values from data rather than fixed literals, such as from a DBIC model or a database. Forms with only hard-coded option literals are not described as affected. Teams that do not use this Perl module can skip it.
Not affected if not-using-data-muform, static-option-literals
Who cares data-muform, perl, web-forms
Data::MuForm and at what version, for example with cpanm --info Data::MuForm or the Perl dependency list.options_<field_name> methods, build_options methods, or element_attr values that include user-supplied text.No fix yet, per the sources.
Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping.
process_attrs writes each attribute value into the markup as is. The select, radio group and checkbox group renderers pass each option to it, so an option's value becomes an unescaped attribute. Option and option group labels are also unescaped, the group label inside a label attribute and the others in element content.
Any application whose option list is built from data rather than literals, using an options_<field_name> method, a build_options method or a DBIC model, allows attacker-influenced text in an option value or label that can embed JavaScript in rendered pages. Attribute values built from data, such as through element_attr, are affected the same way.
This page as .md · .json · in your agent: get_signal("CVE-2026-121632")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.