Cyber ·
CVE-2026-121632: Data::MuForm up to 0.05 does not escape attribute values and option labels in HTML
Advisory published on November 4, 2026 describes missing escaping of attribute values and option labels generated by Data::MuForm up to version 0.05, from the CPAN Security Group.
The CPAN Security Group assigned CVE-2026-121632 to the Data-MuForm distribution in the Perl ecosystem. According to the text forwarded to the oss-sec list on November 4, 2026, versions up to 0.05 render attribute values and option labels into HTML without escaping that content. The flaw falls under output escaping, which can allow markup or script injection when untrusted data reaches a form. The text gives the CVE identifier, the distribution name, the affected version range and a reference to the MetaCPAN record. This excerpt does not state a fixed version or confirmed exploitation details. To verify, consult the original notice on the oss-sec list, the CVE record and the distribution page on MetaCPAN, including its version history and source repository. If your organization uses this library, identify affected applications and handle the update following the maintainer's guidance. Rota Nacional does not patch third-party libraries and does not replace a security review of your application.