CVE-2026-85484: Formander XSS via Unescaped HTML Attribute Values

Vulnerability Key Information Summary Vulnerability Overview Vulnerability ID: CVE-2026-85484 Vulnerability Type: HTML attribute values are not properly escaped for the HTML attribute context, leading to a potential XSS risk Fix Commit: Scope of Impact Affected Files: - - - - Affected Components: The method in the , , and widgets within the Formander form framework Core Issue: When rendering options, the method fails to escape attribute values such as label and value. An attacker can inject HTML tags or scripts by crafting malicious option data Resolution Fix Method: In the method, use to escape attribute values such as label and value Code Example of the Fix: ```perl sub render_option { my $self = shift; my $option = shift; my $label = $option->{label}; my $value = $option->{value}; my $selected = $option->{selected}; my $disabled = $option->{disabled}; my $group = $option->{group}; my $class = $option->{class}; my $id = $option->{id}; my $name = $option->{name}; my $data = $option->{data}; my $onchange = $option->{onchange}; my $onclick = $option->{onclick}; my $onblur = $option->{onblur}; my $onfocus = $option->{onfocus}; my $oninput = $option->{oninput}; my $onkeydown = $option->{onkeydown}; my $onkeyup = $option->{onkeyup}; my $onmousedown = $option->{onmousedown}; my $onmouseup = $option->{onmouseup}; my $onmouseover = $option->{onmouseover}; my $onmouseout = $option->{onmouseout}; my $onsubmit = $option->{onsubmit}; my $onreset = $option->{onreset}; my $onselect = $option->{onselect}; my $onchange = $option->{onchange}; my $onclick = $option->{onclick}; my $onblur = $option->{onblur}; my $onfocus = $option->{onfocus}; my $oninput = $option->{oninput}; my $onkeydown = $option->{onkeydown}; my $onkeyup = $option->{onkeyup}; my $onmousedown = $option->{onmousedown}; my $onmouseup = $option->{onmouseup}; my $onmouseover = $option->{onmouseover}; my $onmouseout = $option->{onmouseout}; my $onsubmit = $option->{onsubmit}; my $onreset = $option->{onreset}; my $onselect = $option->{onselect}; my $onchange = $option->{onchange}; my $onclick = $option->{onclick}; my $onblur = $option->{onblur}; my $onfocus = $option->{onfocus}; my $oninput = $option->{oninput}; my $onkeydown = $option->{onkeydown}; my $onkeyup = $option->{onkeyup}; my $onmousedown = $option->{onmousedown}; my $onmouseup = $option->{onmouseup}; my $onmouseover = $option->{onmouseover}; my $onmouseout = $option->{onmouseout}; my $onsubmit = $option->{onsubmit}; my $onreset = $option->{onreset}; my $onselect = $option->{onselect}; my $onchange = $option->{onchange}; my $onclick = $option->{onclick}; my $onblur = $option->{onblur}; my $onfocus = $option->{onfocus}; my $oninput = $option->{oninput}; my $onkeydown = $option->{onkeydown}; my $onkeyup = $option->{onkeyup}; my $onmousedown = $option->{onmousedown}; my $onmouseup = $option->{onmouseup}; my $onmouseover = $option->{onmouseover}; my $onmouseout = $option->{onmouseout}; my $onsubmit = $option->{onsubmit}; my $onreset = $option->{onreset}; my $onselect = $option->{onselect}; my $onchange = $option->{onchange}; my $onclick = $option->{onclick}; my $onblur = $option->{onblur}; my $onfocus = $option->{onfocus}; my $oninput = $option->{oninput}; my $onkeydown = $option->{onkeydown}; my $onkeyup = $option->{onkeyup}; my $onmousedown = $option->{onmousedown}; my $onmouseup = $option->{onmouseup}; my $onmouseover = $option->{onmouseover}; my $onmouseout = $option->{onmouseout}; my $onsubmit = $option->{onsubmit}; my $onreset = $option->{onreset}; my $onselect = $option->{onselect}; my $onchange = $option->{onchange}; my $onclick = $option->{onclick}; my $onblur = $option->{onblur}; my $onfocus = $option->{onfocus}; my $oninput = $option->{oninput}; my $onkeydown = $option->{onkeydown}; my $onkeyup = $option->{onkeyup}; my $onmousedown = $option->{onmousedown}; my $onmouseup = $option->{onmouseup}; my $onmouseover = $option->{onmouseover}; my $onmouseout = $option->{onmouseout}; my $onsubmit = $option->{onsubmit}; my $onreset = $option->{onreset}; my $onselect = $option->{onselect}; my $onchange = $option->{onchange}; my $onclick = $option->{onclick}; my $onblur = $option->{onblur}; my $onfocus = $option->{onfocus}; my $oninput = $option->{oninput}; my $onkeydown = $option->{onkeydown}; my $onkeyup = $option->{onkeyup}; my $onmousedown = $option->{onmousedown}; my $onmouseup = $option->{onmouseup}; my $onmouseover = $option->{onmouseover}; my $onmouseout = $option->{onmouseout}; my $onsubmit = $option->{onsubmit}; my $onreset = $option->{onreset}; my $onselect = $option->{onselect}; my $onchange = $option->{onchange}; my $onclick = $option->{onclick}; my $onblur = $option->{onblur}; my $onfocus = $option->{onfocus}; my $oninput = $option

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-85484: Formander XSS via Unescaped HTML Attribute Values

More from this source