{"id":"CVE-2026-96379","kind":"vulnerability","aliases":["CVE-2026-96379"],"related":[],"title":"Drupal CookieCuttr: stored XSS lets attackers inject scripts into pages","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal CookieCuttr allows Stored XSS. This issue affects CookieCuttr versions: from 2.0.0 to 2.0.3.","summary":"CookieCuttr, a Drupal module for cookie consent banners, has a stored cross-site scripting flaw in versions 2.0.0 through 2.0.3. An attacker who can store input that the module later renders can run scripts in other visitors' browsers.","severity":"unknown","cvss":null,"epss":0.0015,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cookiecuttr","drupal","package","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed CookieCuttr version with `drush pm:list --filter=cookiecuttr` or the Drupal admin Extend page\n- Look for the module in `modules/contrib/cookiecuttr` and read its `*.info.yml` version field","fix":"- Upgrade CookieCuttr to a version later than `2.0.3` (exact fixed version: unknown from the sources)","status":"open","published_at":"2026-10-22T02:17:08+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T05:00:33+00:00","updated_at":"2026-10-25T05:00:33+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:00:33Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade CookieCuttr to a version later than `2.0.3` (exact fixed version: unknown from the sources)","reach":"internet","title":"Drupal CookieCuttr: stored XSS lets attackers inject scripts into pages","impact":"medium","summary":"CookieCuttr, a Drupal module for cookie consent banners, has a stored cross-site scripting flaw in versions 2.0.0 through 2.0.3. An attacker who can store input that the module later renders can run scripts in other visitors' browsers.","category":"package","nicknames":[],"who_cares":["drupal","cookiecuttr","php"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker scripts run in visitors' browsers, stealing sessions","analyst_note":"Check the Drupal security advisory for CookieCuttr to confirm the fixed version, which input is stored, and which roles can supply it.","how_to_check":"- Check the installed CookieCuttr version with `drush pm:list --filter=cookiecuttr` or the Drupal admin Extend page\n- Look for the module in `modules/contrib/cookiecuttr` and read its `*.info.yml` version field","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites running the CookieCuttr module in versions 2.0.0 to 2.0.3 are potentially exposed. The sources do not say which roles can store the input, so sites that restrict who can edit content or banner text are likely lower risk. Sites without the module can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000624,"input_tokens":3342,"output_tokens":580,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-96379':13A,16A '2.0.0':39B,85C '2.0.3':41B,87C 'affect':81C 'allow':76C 'attack':6A,43B 'banner':28B 'browser':59B 'consent':27B 'cooki':26B 'cookiecuttr':2A,17B,21B,75C,82C 'cross':33B,69C 'cross-sit':32B,68C 'cve':11A,14A 'drupal':1A,18B,23B,74C 'flaw':36B 'generat':67C 'improp':60C 'inject':7A 'input':47B,63C 'issu':80C 'later':51B 'let':5A 'modul':24B,50B 'neutral':61C 'packag':19B 'page':10A,66C 'php':20B 'render':52B 'run':54B 'script':8A,35B,55B,71C 'site':34B,70C 'store':3A,31B,46B,77C 'version':38B,83C 'visitor':58B 'vulner':72C 'web':65C 'xss':4A,78C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites running the CookieCuttr module in versions 2.0.0 to 2.0.3 are potentially exposed. The sources do not say which roles can store the input, so sites that restrict who can edit content or banner text are likely lower risk. Sites without the module can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96379","severity":null,"published_at":"2026-10-22T02:17:08+00:00","modified_at":"2026-10-22T16:21:29+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96379","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96379","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}