Listen to this Post
CVE-2026-105950 represents a security vulnerability discovered within getformwork formwork versions up to 2.3.12.
The core issue originates inside the component URI Sanitizer, specifically within the DomSanitizer::sanitizeNodeAttribute function.
This function resides in the source file formwork/src/Sanitizer/DomSanitizer.php and handles HTML node attribute sanitization.
When processing form-related attributes, the sanitizer fails to properly neutralize malicious inputs passed via the formaction argument.
Because of this missing validation, an attacker can supply specially crafted JavaScript URI schemes inside form overriding elements.
The vulnerability allows remote execution flows where arbitrary scripts can be triggered during user interactions.
Attackers can leverage this flaw to launch Cross-Site Scripting (XSS) attacks against authenticated users of the platform.
The attack vector requires network access with low privileges and depends heavily on user interaction to execute the payload.
Although confidentiality impact is rated as none, integrity is affected because unauthorized script context can be introduced.
The official repository managed by capivara-research highlights the structure where release artifacts and sanitization bypasses occur.
Remediation requires upgrading the software package to version 2.3.13, which includes the necessary patch code adjustments.
The patch successfully implements stricter checks on attribute schemes to prevent malicious execution vectors.
Without applying this update, web applications remain vulnerable to session manipulation and script injection risks.
Security teams should audit their deployed instances to ensure all vulnerable code components are updated immediately.
DailyCVE Form:
Platform: Getformwork Formwork
Version: Up to 2.3.12
Vulnerability : Cross-Site Scripting
Severity: Medium
date: October 6 2026
Prediction: Already patched 2026
What Undercode Say:
git clone https://github.com/capivara-research/CVE-2026-105950 cd CVE-2026-105950 php -r "require 'formwork/src/Sanitizer/DomSanitizer.php';"
// DomSanitizer::sanitizeNodeAttribute implementation flaw
if ($attr === 'formaction') {
// Lacks proper filtering against javascript: URI injection schemes
}
Exploit: (Educational Purposes!)
<form> <button formaction="javascript:alert(document.cookie)">Trigger XSS</button> </form>
Protection: from this CVE
Upgrade getformwork formwork to version 2.3.13 or apply patch commit 729701e59c5886685c5a1d477bdc3035e41f18b1. Ensure rigorous URI scheme validation rules inside custom DOM attribute sanitizers.
Impact:
Remote attackers can execute arbitrary JavaScript code within the victim’s browser session, leading to session hijacking, data theft, and loss of application integrity.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
