{"id":"CVE-2026-96359","kind":"vulnerability","aliases":["CVE-2026-96359"],"related":[],"title":"Drupal Webform: cross-site scripting flaw in page generation","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","summary":"Drupal's Webform module fails to neutralize input when generating web pages, enabling cross-site scripting. An attacker can run script in another user's browser session on the affected site.","severity":"medium","cvss":4.6,"epss":0.00175,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","webform"],"not_affected_if":["webform-not-installed"],"how_to_check":"- Check the installed Webform version with `drush pm:list --filter=webform` or the Extend page in Drupal admin\n- Flag any install at `6.2.12` or earlier, or in the `6.3.0` to `6.3.1` range","fix":"- Upgrade the Webform module to a release above `6.3.1` and above `6.2.12`, per the Drupal security advisory\n- Clear Drupal caches after updating","status":"open","published_at":"2026-10-22T02:17:05+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:35:27+00:00","updated_at":"2026-10-25T04:35:27+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:35:27Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Webform module to a release above `6.3.1` and above `6.2.12`, per the Drupal security advisory\n- Clear Drupal caches after updating","reach":"internet","title":"Drupal Webform: cross-site scripting flaw in page generation","impact":"medium","summary":"Drupal's Webform module fails to neutralize input when generating web pages, enabling cross-site scripting. An attacker can run script in another user's browser session on the affected site.","category":"package","nicknames":[],"who_cares":["drupal","webform","php"],"confidence":0.6,"needs_auth":"unknown","worst_case":"script runs in visitors' browsers, session data can be stolen","analyst_note":"Check the Drupal security advisory for the exact input field, required permissions and fixed version numbers, which the NVD entry does not give.","how_to_check":"- Check the installed Webform version with `drush pm:list --filter=webform` or the Extend page in Drupal admin\n- Flag any install at `6.2.12` or earlier, or in the `6.3.0` to `6.3.1` range","needs_analyst":true,"not_affected_if":["webform-not-installed"],"who_is_affected":"Sites running the Drupal Webform module in the affected version ranges are exposed, most likely where forms accept input from anonymous visitors and that input is shown back on pages. Sites that do not use Webform can skip it. The sources do not describe further conditions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000603,"input_tokens":3369,"output_tokens":533,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-96359':13A,16A '0.0.0':81C '6.2.12':83C '6.3.0':85C '6.3.1':87C 'affect':51B,77C 'allow':69C 'anoth':44B 'attack':39B 'browser':47B 'cross':4A,35B,62C,71C 'cross-sit':3A,34B,61C,70C 'cve':11A,14A 'drupal':1A,17B,21B,67C 'enabl':33B 'fail':25B 'flaw':7A 'generat':10A,30B,60C 'improp':53C 'input':28B,56C 'issu':76C 'modul':24B 'neutral':27B,54C 'packag':18B 'page':9A,32B,59C 'php':19B 'run':41B 'script':6A,37B,42B,64C,73C 'session':48B 'site':5A,36B,52B,63C,72C 'user':45B 'version':79C 'vulner':65C 'web':31B,58C 'webform':2A,20B,23B,68C,78C 'xss':74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Webform module in the affected version ranges are exposed, most likely where forms accept input from anonymous visitors and that input is shown back on pages. Sites that do not use Webform can skip it. The sources do not describe further conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96359","severity":null,"published_at":"2026-10-22T02:17:05+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96359","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96359","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}