CVE-2026-96359: CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Drupal Webform

This vulnerability in the Drupal Webform module is classified as CWE-79, indicating improper neutralization of input during web page generation, which leads to Cross-Site Scripting (XSS). The affected versions include all releases from the initial version 0.0.0 up to 6.2.12 (exclusive), and from 6.3.0 up to 6.3.1 (exclusive). The vulnerability allows attackers to inject malicious scripts into web pages generated by the Webform module, potentially impacting users who view those pages. There is no information about active exploitation or a CVSS score. No patch or remediation details are provided in the input data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or redirection to malicious sites. However, no known exploits in the wild are reported. The impact is limited to affected versions of the Drupal Webform module.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Drupal's official security advisories for updates and consider applying any available updates beyond version 6.2.12 and 6.3.1 when released. Until a fix is available, consider restricting user input or applying web application firewall rules to mitigate potential exploitation.