CVE-2026-96358 Drupal CVE debrief

Who should care

Defenders managing Drupal installations with the Webform module should assess exposure and prioritize remediation. This includes Webform users and administrators responsible for maintaining Drupal sites.

Why it matters

CVE-2026-96358 is a Cross-site Scripting (XSS) vulnerability in Drupal Webform that requires immediate attention from defenders. It affects multiple versions of Webform, and exploitation could lead to unauthorized actions or data exposure. Defenders should assess exposure, prioritize remediation, and monitor for potential attacks.

• Potential for attackers to inject malicious scripts, leading to unauthorized actions or data exposure
• Risk of compromised user sessions or sensitive information disclosure
• Possible disruption of web application functionality
• Need for defenders to verify Webform version numbers and apply patches

Technical summary

The Drupal Webform module is vulnerable to Cross-site Scripting (XSS). The issue affects Webform versions from 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1. This vulnerability allows attackers to inject malicious scripts into web pages generated by Webform. The vulnerability is caused by improper neutralization of input during web page generation. Defenders should assess exposure, prioritize remediation, and monitor for potential attacks.

Defensive priority

Defenders should prioritize assessment and remediation of this vulnerability, especially those managing Drupal Webform installations.

Recommended defensive actions

• Assess exposure of Drupal Webform installations to this vulnerability
• Verify version numbers and apply patches or updates as available
• Monitor for potential XSS attacks
• Review and update security configurations for Webform

Evidence notes

The CVE record and source item provide details on the vulnerability, including affected versions and a reference to the Drupal security advisory. The vulnerability was reported by a security researcher and verified by the Drupal security team. The CVE record provides a comprehensive overview of the vulnerability, including its impact and recommended actions for defenders. The Drupal security advisory provides additional information on the vulnerability and guidance on applying patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.