DRUPAL-CONTRIB-2020-013
The Webform module allows site builders to create forms.
The module doesn't sufficiently prevent malicious code from being render via an options elements (i.e select menu, checkboxes, radios, etc...) under the scenario where the site builder allows the raw option value to be displayed.
This vulnerability is mitigated by the fact that site builder must be allowed to build webform and select raw as the options element's submission display.
What each source reports
OSV No score
The Webform module allows site builders to create forms.
The module doesn't sufficiently prevent malicious code from being render via an options elements (i.e select menu, checkboxes, radios, etc...) under the scenario where the site builder allows the raw option value to be displayed.
This vulnerability is mitigated by the fact that site builder must be allowed to build webform and select raw as the options element's submission display.
- Record
DRUPAL-CONTRIB-2020-013- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/webformPackagist:https://packages.drupal.org/8 |
before 5.11.0 | 5.11.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2020-013 is a vulnerability with no CVSS score yet in drupal/webform, published May 6, 2020. No source lists public exploit code. Fixed in drupal/webform 5.11.0.