Data::MuForm versions through 0.05 render option values and labels, as well as attribute values, directly into HTML without escaping. This flaw enables an attacker to inject malicious JavaScript via option values or labels that are sourced from external data such as options_<field_name> methods, build_options, or DBIC models. When a user views a page containing the vulnerable form, the injected script runs in the user’s browser context, potentially compromising session integrity, defacing content, and exfiltrating sensitive information. The weakness corresponds to CWE‑79, classifying it as a cross‑site scripting vulnerability.

Perl applications that employ the Data::MuForm module, specifically versions up to and including 0.05. Any system that builds form option lists from dynamic data sources or passes arbitrary attribute values through element_attr functions is susceptible.

An attacker can exploit the flaw by providing crafted data to an option list or attribute value via any interface that populates the Data::MuForm renderer—such as database queries, user input, or service endpoints. Since the vulnerable code does not perform HTML escaping, the malicious payload is reflected verbatim into the page. The exploit requires that the rendered form be accessed by a user with a browser that interprets the injected script. No authentication is needed, so the risk is high for any client who can view the vulnerable page. No EPSS score is available and the vulnerability is not yet listed in the KEV catalog, but the lack of a metric does not diminish the urgency of patching or mitigating the issue.