{"id":"CVE-2026-96357","kind":"vulnerability","aliases":["CVE-2026-96357"],"related":[],"title":"Drupal Webform: stored cross-site scripting in web page output","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","summary":"The Drupal Webform module fails to neutralize input when generating web pages, allowing stored XSS. An attacker who can submit or store crafted content can run scripts in other users' browsers.","severity":"medium","cvss":4.6,"epss":0.00172,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted","webform"],"not_affected_if":["patched-version","webform-not-installed"],"how_to_check":"- Check the installed Webform version with `drush pm:list --filter=webform` or the Drupal admin Extend page\n- Confirm whether the installed version is between `0.0.0` and `6.2.12`, or `6.3.0` to `6.3.1`","fix":"- Upgrade the Drupal Webform module to a release newer than `6.3.1` or `6.2.12` (exact fixed version unknown from sources)","status":"open","published_at":"2026-10-22T02:17:05+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:35:28+00:00","updated_at":"2026-10-25T04:35:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:35:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Drupal Webform module to a release newer than `6.3.1` or `6.2.12` (exact fixed version unknown from sources)","reach":"internet","title":"Drupal Webform: stored cross-site scripting in web page output","impact":"medium","summary":"The Drupal Webform module fails to neutralize input when generating web pages, allowing stored XSS. An attacker who can submit or store crafted content can run scripts in other users' browsers.","category":"package","nicknames":[],"who_cares":["drupal","webform","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker scripts run in other users' browsers via stored content","analyst_note":"","how_to_check":"- Check the installed Webform version with `drush pm:list --filter=webform` or the Drupal admin Extend page\n- Confirm whether the installed version is between `0.0.0` and `6.2.12`, or `6.3.0` to `6.3.1`","needs_analyst":false,"not_affected_if":["webform-not-installed","patched-version"],"who_is_affected":"Sites running the Drupal Webform module in the affected version ranges. Exposure depends on who can enter content that is later rendered to other users, so sites with only trusted editors are at lower risk. Sites not using Webform can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000584,"input_tokens":3361,"output_tokens":496,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-96357':14A,17A '0.0.0':80C '6.2.12':82C '6.3.0':84C '6.3.1':86C 'affect':76C 'allow':36B,71C 'attack':40B 'browser':54B 'content':47B 'craft':46B 'cross':5A,64C 'cross-sit':4A,63C 'cve':12A,15A 'drupal':1A,18B,25B,69C 'fail':28B 'generat':33B,62C 'host':22B 'improp':55C 'input':31B,58C 'issu':75C 'modul':27B 'neutral':30B,56C 'output':11A 'packag':19B 'page':10A,35B,61C 'run':49B 'script':7A,50B,66C 'self':21B 'self-host':20B 'site':6A,65C 'store':3A,37B,45B,72C 'submit':43B 'user':53B 'version':78C 'vulner':67C 'web':9A,34B,60C 'webform':2A,23B,26B,70C,77C 'xss':38B,73C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Webform module in the affected version ranges. Exposure depends on who can enter content that is later rendered to other users, so sites with only trusted editors are at lower risk. Sites not using Webform can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96357","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96357","severity":null,"published_at":"2026-10-22T02:17:05+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96357","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96357","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}