This vulnerability (CVE-2026-6095) in Drupal Orejime before version 2.0.16 is due to improper neutralization of input during web page generation, classified as CWE-79 (Cross-Site Scripting). It allows an attacker to execute scripts in the context of the victim's browser, potentially leading to limited confidentiality and integrity impact. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a user's browser session, potentially leading to limited disclosure or modification of information accessible to the user. There is no impact on system availability. The overall impact is rated medium severity based on the CVSS score of 6.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Drupal's official channels for updates. Until a fix is available, consider applying input validation or output encoding workarounds if feasible, but no vendor-endorsed mitigation is currently documented.