{"id":"CVE-2026-96358","kind":"vulnerability","aliases":["CVE-2026-96358"],"related":[],"title":"Drupal Webform: input handling flaw allows cross-site scripting in pages","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","summary":"Drupal Webform versions up to 6.2.12 and 6.3.0 through 6.3.1 fail to neutralize input when generating web pages. An attacker can inject script that runs in other users' browsers.","severity":"medium","cvss":4.6,"epss":0.00226,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted","webform"],"not_affected_if":["patched-version","webform-not-installed"],"how_to_check":"- Check the installed Webform module version in the Drupal admin under Extend, or with `drush pm:list --filter=webform`\n- Confirm whether the version is at or below `6.2.12` or within `6.3.0` to `6.3.1`","fix":"- Upgrade the Drupal Webform module to a version newer than `6.3.1` and newer than `6.2.12`, the fixed release is unknown from the sources\n- Check the Drupal security advisory for the exact patched version","status":"open","published_at":"2026-10-22T02:17:05+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:35:27+00:00","updated_at":"2026-10-25T04:35:27+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:35:27Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Drupal Webform module to a version newer than `6.3.1` and newer than `6.2.12`, the fixed release is unknown from the sources\n- Check the Drupal security advisory for the exact patched version","reach":"internet","title":"Drupal Webform: input handling flaw allows cross-site scripting in pages","impact":"medium","summary":"Drupal Webform versions up to 6.2.12 and 6.3.0 through 6.3.1 fail to neutralize input when generating web pages. An attacker can inject script that runs in other users' browsers.","category":"package","nicknames":[],"who_cares":["drupal","webform","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in victims' browsers on the Drupal site","analyst_note":"","how_to_check":"- Check the installed Webform module version in the Drupal admin under Extend, or with `drush pm:list --filter=webform`\n- Confirm whether the version is at or below `6.2.12` or within `6.3.0` to `6.3.1`","needs_analyst":false,"not_affected_if":["webform-not-installed","patched-version"],"who_is_affected":"Sites running the Drupal Webform module in the affected version ranges, where form content or submissions are rendered to visitors or administrators. Sites without Webform installed or on patched versions can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000596,"input_tokens":3369,"output_tokens":518,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-96358':15A,18A '0.0.0':82C '6.2.12':30B,84C '6.3.0':32B,86C '6.3.1':34B,88C 'affect':78C 'allow':6A,70C 'attack':44B 'browser':53B 'cross':8A,63C,72C 'cross-sit':7A,62C,71C 'cve':13A,16A 'drupal':1A,19B,25B,68C 'fail':35B 'flaw':5A 'generat':40B,61C 'handl':4A 'host':23B 'improp':54C 'inject':46B 'input':3A,38B,57C 'issu':77C 'neutral':37B,55C 'packag':20B 'page':12A,42B,60C 'run':49B 'script':10A,47B,65C,74C 'self':22B 'self-host':21B 'site':9A,64C,73C 'user':52B 'version':27B,80C 'vulner':66C 'web':41B,59C 'webform':2A,24B,26B,69C,79C 'xss':75C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Webform module in the affected version ranges, where form content or submissions are rendered to visitors or administrators. Sites without Webform installed or on patched versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96358","severity":null,"published_at":"2026-10-22T02:17:05+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96358","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96358","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}