CVE-2026-105950 in formwork
Summary
by MITRE • 10/06/2026
A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.3.13 is recommended to address this issue. The name of the patch is 729701e59c5886685c5a1d477bdc3035e41f18b1. Upgrading the affected component is advised.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in getformwork formwork versions up to 2.3.12 represents a significant security risk stemming from improper input validation within the URI Sanitizer component. Specifically, the flaw resides in the DomSanitizer::sanitizeNodeAttribute function located in the file formwork/src/Sanitizer/DomSanitizer.php. This function is responsible for processing and sanitizing attributes associated with HTML nodes to prevent malicious content injection. However, it fails to adequately validate or escape specific attribute values, particularly those related to URI schemes such as formaction. The lack of rigorous checking allows an attacker to inject executable scripts through specially crafted input fields that utilize the formaction attribute, thereby bypassing existing sanitization logic designed to protect against cross-site scripting attacks.
This technical flaw directly facilitates a Cross-Site Scripting (XSS) attack vector, categorized under CWE-79 in the Common Weakness Enumeration standards. The vulnerability allows for remote exploitation, meaning an attacker does not require prior authentication or physical access to the target system. By manipulating the formaction argument, which dictates where form data is submitted when a user submits a form, an adversary can inject malicious JavaScript code into the web page context of other users. When these victims interact with the compromised form element, their browsers execute the injected script within the security context of the vulnerable application. This execution environment grants the attacker access to sensitive information such as session cookies, authentication tokens, or personally identifiable data stored in local storage, effectively compromising user privacy and account integrity.
The operational impact of this vulnerability extends beyond simple defacement or minor disruption. Successful exploitation can lead to full account takeover if session hijacking is achieved through cookie theft. Furthermore, attackers may leverage the XSS payload to perform actions on behalf of the victim without their consent, such as changing email addresses, initiating financial transactions, or modifying user preferences. This aligns with techniques observed in the MITRE ATT&CK framework under T1059.007 (JavaScript) and potentially T1213 (Data from Information Repositories), highlighting the potential for both active exploitation of client-side logic and passive data exfiltration. The remote nature of this attack vector significantly increases its severity, as it can be triggered via phishing links or embedded in third-party content that interacts with the vulnerable formwork component.
To mitigate this risk, immediate action is required to update the getformwork framework to version 2.3.13 or later. This release includes a specific patch identified by commit hash 729701e59c5886685c5a1d477bdc3035e41f18b1, which addresses the sanitization logic for node attributes. The update ensures that all URI-based attributes are properly validated against a strict allowlist of safe schemes and that any potentially dangerous characters are correctly escaped or removed before being rendered in the DOM. In addition to upgrading the software, developers should implement defense-in-depth strategies such as Content Security Policy (CSP) headers to restrict script execution sources and ensure that all user inputs undergo rigorous server-side validation regardless of client-side sanitization measures. Regular security audits and static code analysis focused on input handling functions can further reduce the likelihood of similar vulnerabilities in future development cycles.