{"id":"CVE-2026-96360","aliases":["DRUPAL-CONTRIB-2026-154","EUVD-2026-107845","GHSA-wmg8-83xq-9c4x"],"status":"published","title":"Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","severity":{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00234,"percentile":0.14353,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-09-23T16:11:28Z","modified":"2026-11-05T21:32:25Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/webform","fixed_in":["6.2.12","6.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/webform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.12"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.3.0"},{"fixed":"6.3.1"}]}]}],"products":[{"vendor":"drupal","product":"webform"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-154","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96360","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wmg8-83xq-9c4x"},{"url":"https://git.drupalcode.org/project/webform","tags":["web"]},{"url":"https://www.drupal.org/project/webform","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96360.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-96360","title":"Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","status":"published","published":"2026-10-22T01:21:48.842Z","modified":"2026-10-22T15:15:45.058Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:00.511569Z"}],"euvd":[{"id":"EUVD-2026-107845","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","status":"published","published":"2026-10-22T01:21:48Z","modified":"2026-10-22T15:15:45Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:59:34.732609Z"}],"ghsa":[{"id":"GHSA-wmg8-83xq-9c4x","title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")...","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","status":"published","published":"2026-10-22T03:33:43Z","modified":"2026-10-22T18:39:26Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:14:16.981825Z"}],"nvd":[{"id":"CVE-2026-96360","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","status":"published","published":"2026-10-22T02:17:06.017Z","modified":"2026-10-22T16:54:17.39Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:13:02.371082Z"}],"osv":[{"id":"CVE-2026-96360","title":"Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","status":"published","published":"2026-10-22T01:21:48.842Z","modified":"2026-11-05T21:32:25.781754845Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-05T22:00:34.245765Z"},{"id":"DRUPAL-CONTRIB-2026-154","description":"The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.\n\nThe module provides JavaScript behaviours for announcing dynamic form updates to assistive technologies.\n\nIn some configurations, due to improper sanitisation, specially crafted announcement text could create a cross-site scripting risk for users interacting with the affected Webform.","status":"published","published":"2026-09-23T16:11:28Z","modified":"2026-09-23T17:40:57.084595Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}