CYBERSECURITYTRACKER
Permanent story citation

CVE-2026-121632: Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 12384

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2026-121632: Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping

Data::MuForm, a Perl module, contains a cross-site scripting (XSS) vulnerability in versions through 0.05 where attribute values and option labels are rendered into HTML without proper escaping. The vulnerability, tracked as CVE-2026-121632, allows malicious input to be executed in the browser context of affected applications.

Why it matters: Developers using Data::MuForm to generate web forms must upgrade immediately to patch this XSS flaw, which enables attackers to inject arbitrary scripts into user sessions if untrusted data reaches form rendering.

CVEsCVE-2026-121632
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary