Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping, allowing attacker-influenced text to embed JavaScript in rendered pages. This affects attribute values and option labels generated from data sources, potentially leading to cross-site scripting (XSS).