---
id: "CVE-2026-96358"
kind: "vulnerability"
aliases: ["CVE-2026-96358"]
title: "Drupal Webform: input handling flaw allows cross-site scripting in pages"
severity: "medium"
cvss: 4.6
epss: 0.00226
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "self-hosted", "webform"]
not_affected_if: ["patched-version", "webform-not-installed"]
published_at: "2026-10-22T02:17:05+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:35:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96358", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-96358", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Drupal Webform: input handling flaw allows cross-site scripting in pages

Drupal Webform versions up to 6.2.12 and 6.3.0 through 6.3.1 fail to neutralize input when generating web pages. An attacker can inject script that runs in other users' browsers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Webform module version in the Drupal admin under Extend, or with `drush pm:list --filter=webform`
- Confirm whether the version is at or below `6.2.12` or within `6.3.0` to `6.3.1`

## Fix

- Upgrade the Drupal Webform module to a version newer than `6.3.1` and newer than `6.2.12`, the fixed release is unknown from the sources
- Check the Drupal security advisory for the exact patched version

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96358
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-96358

## From the sources

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_