{"id":"CVE-2026-6871","aliases":["DRUPAL-CONTRIB-2026-033","EUVD-2026-30988","GHSA-rg7p-g694-c73p"],"status":"published","title":"Obfuscate - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-033","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS).\n\nThis issue affects Obfuscate: from 0.0.0 before 2.0.2.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00196,"percentile":0.09345,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-04-22T17:47:43Z","modified":"2026-10-31T10:30:18Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/obfuscate","fixed_in":["2.0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/obfuscate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2"}]}]}],"products":[{"vendor":"drupal","product":"obfuscate"},{"vendor":"obfuscate_project","product":"obfuscate"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-033","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6871","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rg7p-g694-c73p"},{"url":"https://git.drupalcode.org/project/obfuscate","tags":["web"]},{"url":"https://www.drupal.org/project/obfuscate","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6871.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-6871","title":"Obfuscate - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-033","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS).\n\nThis issue affects Obfuscate: from 0.0.0 before 2.0.2.","status":"published","published":"2026-05-19T22:28:40.232Z","modified":"2026-05-20T13:22:00.513Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:50:04.986624Z"}],"euvd":[{"id":"EUVD-2026-30988","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS).\n\nThis issue affects Obfuscate: from 0.0.0 before 2.0.2.","status":"published","published":"2026-05-19T22:28:40Z","modified":"2026-05-20T13:22:00Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:21:14.831553Z"}],"ghsa":[{"id":"GHSA-rg7p-g694-c73p","title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")...","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS).\n\nThis issue affects Obfuscate: from 0.0.0 before 2.0.2.","status":"published","published":"2026-05-20T00:31:42Z","modified":"2026-05-20T15:36:35Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:08:13.87243Z"}],"nvd":[{"id":"CVE-2026-6871","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS).\n\nThis issue affects Obfuscate: from 0.0.0 before 2.0.2.","status":"published","published":"2026-05-19T23:16:58.467Z","modified":"2026-07-24T08:10:00.15Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:19.752984Z"}],"osv":[{"id":"CVE-2026-6871","title":"Obfuscate - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-033","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS).\n\nThis issue affects Obfuscate: from 0.0.0 before 2.0.2.","status":"published","published":"2026-05-19T22:28:40.232Z","modified":"2026-11-03T02:31:07.471044278Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-03T03:05:53.289262Z"},{"id":"DRUPAL-CONTRIB-2026-033","description":"This module enables you to obfuscate email addresses in content.\n\nThe module doesn't sufficiently sanitize user input via the Twig filter.\n\nThis vulnerability is mitigated by the fact that it only affects sites using the ROT13 encoding and where an attacker can enter content that is filtered using the module's Twig filter.","status":"published","published":"2026-04-22T17:47:43Z","modified":"2026-09-10T03:45:53.394312606Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}