The issue concerns an eval injection that can lead to possible information disclosure, impact on data integrity, and execution of arbitrary code. This can be exploited via a specially crafted query string, for example, a malicious URL that injects unauthorized code. The `getSubmitValue` method, `validate` method, ` setOptions` method, ` findValue` method, and ` prepareValue` method in `HTML QuickForm`, `HTML QuickForm hierselect`, and `HTML QuickForm element` are affected.