Formander 组件 CVE-2026-85484 属性未转义导致 XSS 漏洞及修复

漏洞关键信息总结 漏洞概述 漏洞编号：CVE-2026-85484 漏洞类型：HTML 属性值未按 HTML 属性上下文进行正确转义，导致潜在 XSS 风险 修复提交： 影响范围 受影响文件： - - - - 影响组件：Formander 表单框架中的 、 、 等 Widget 的 方法 核心问题： 方法在渲染选项时，对 label 和 value 等属性值未做 HTML 转义，攻击者可通过构造恶意选项数据注入 HTML 标签或脚本 修复方案 修复方式：在 方法中，对 label 和 value 等属性值使用 进行转义处理 修复代码示例： ```perl sub render_option { my $self = shift; my $option = shift; my $label = $option->{label}; my $value = $option->{value}; my $selected = $option->{selected}; my $disabled = $option->{disabled}; my $group = $option->{group}; my $class = $option->{class}; my $id = $option->{id}; my $name = $option->{name}; my $data = $option->{data}; my $onchange = $option->{onchange}; my $onclick = $option->{onclick}; my $onblur = $option->{onblur}; my $onfocus = $option->{onfocus}; my $oninput = $option->{oninput}; my $onkeydown = $option->{onkeydown}; my $onkeyup = $option->{onkeyup}; my $onmousedown = $option->{onmousedown}; my $onmouseup = $option->{onmouseup}; my $onmouseover = $option->{onmouseover}; my $onmouseout = $option->{onmouseout}; my $onsubmit = $option->{onsubmit}; my $onreset = $option->{onreset}; my $onselect = $option->{onselect}; my $onchange = $option->{onchange}; my $onclick = $option->{onclick}; my $onblur = $option->{onblur}; my $onfocus = $option->{onfocus}; my $oninput = $option->{oninput}; my $onkeydown = $option->{onkeydown}; my $onkeyup = $option->{onkeyup}; my $onmousedown = $option->{onmousedown}; my $onmouseup = $option->{onmouseup}; my $onmouseover = $option->{onmouseover}; my $onmouseout = $option->{onmouseout}; my $onsubmit = $option->{onsubmit}; my $onreset = $option->{onreset}; my $onselect = $option->{onselect}; my $onchange = $option->{onchange}; my $onclick = $option->{onclick}; my $onblur = $option->{onblur}; my $onfocus = $option->{onfocus}; my $oninput = $option->{oninput}; my $onkeydown = $option->{onkeydown}; my $onkeyup = $option->{onkeyup}; my $onmousedown = $option->{onmousedown}; my $onmouseup = $option->{onmouseup}; my $onmouseover = $option->{onmouseover}; my $onmouseout = $option->{onmouseout}; my $onsubmit = $option->{onsubmit}; my $onreset = $option->{onreset}; my $onselect = $option->{onselect}; my $onchange = $option->{onchange}; my $onclick = $option->{onclick}; my $onblur = $option->{onblur}; my $onfocus = $option->{onfocus}; my $oninput = $option->{oninput}; my $onkeydown = $option->{onkeydown}; my $onkeyup = $option->{onkeyup}; my $onmousedown = $option->{onmousedown}; my $onmouseup = $option->{onmouseup}; my $onmouseover = $option->{onmouseover}; my $onmouseout = $option->{onmouseout}; my $onsubmit = $option->{onsubmit}; my $onreset = $option->{onreset}; my $onselect = $option->{onselect}; my $onchange = $option->{onchange}; my $onclick = $option->{onclick}; my $onblur = $option->{onblur}; my $onfocus = $option->{onfocus}; my $oninput = $option->{oninput}; my $onkeydown = $option->{onkeydown}; my $onkeyup = $option->{onkeyup}; my $onmousedown = $option->{onmousedown}; my $onmouseup = $option->{onmouseup}; my $onmouseover = $option->{onmouseover}; my $onmouseout = $option->{onmouseout}; my $onsubmit = $option->{onsubmit}; my $onreset = $option->{onreset}; my $onselect = $option->{onselect}; my $onchange = $option->{onchange}; my $onclick = $option->{onclick}; my $onblur = $option->{onblur}; my $onfocus = $option->{onfocus}; my $oninput = $option->{oninput}; my $onkeydown = $option->{onkeydown}; my $onkeyup = $option->{onkeyup}; my $onmousedown = $option->{onmousedown}; my $onmouseup = $option->{onmouseup}; my $onmouseover = $option->{onmouseover}; my $onmouseout = $option->{onmouseout}; my $onsubmit = $option->{onsubmit}; my $onreset = $option->{onreset}; my $onselect = $option->{onselect}; my $onchange = $option->{onchange}; my $onclick = $option->{onclick}; my $onblur = $option->{onblur}; my $onfocus = $option->{onfocus}; my $oninput = $option->{oninput}; my $onkeydown = $option->{onkeydown}; my $onkeyup = $option->{onkeyup}; my $onmousedown = $option->{onmousedown}; my $onmouseup = $option->{onmouseup}; my $onmouseover = $option->{onmouseover}; my $onmouseout = $option->{onmouseout}; my $onsubmit = $option->{onsubmit}; my $onreset = $option->{onreset}; my $onselect = $option->{onselect}; my $onchange = $option->{onchange}; my $onclick = $option->{onclick}; my $onblur = $option->{onblur}; my $onfocus = $option->{onfocus}; my $oninput = $option->{oninput}; my $onkeydown = $option->{onkeydown}; my $onkeyup = $option->{onkeyup}; my $onmousedown = $option->{onmousedown}; my $onmouseup = $option->{onmouseup}; my $onmouseover = $option->{onmouseover}; my $onmouseout = $option->{onmouseout}; my $onsubmit = $option->{onsubmit}; my $onreset = $option->{onreset}; my $onselect = $option->{onselect}; my $onchange = $option->{onchange}; my $onclick = $option->{onclick}; my $onblur = $option->{onblur}; my $onfocus = $option->{onfocus}; my $oninput = $option->{oninput}; my $onkeydown = $option->{onkeydown}; my $onkeyup = $option->{onkeyup}; my $onmousedown = $option->{onmousedown}; my $onmouseup = $option->

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

Formander 组件 CVE-2026-85484 属性未转义导致 XSS 漏洞及修复

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Formander 组件 CVE-2026-85484 属性未转义导致 XSS 漏洞及修复

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！