CVE-2026-96362: CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Drupal Webform

This vulnerability in the Drupal Webform module is classified as CWE-79, indicating improper neutralization of input during web page generation, which leads to Cross-Site Scripting (XSS). The affected versions are >=0.0.0 <6.2.12 and >=6.3.0 <6.3.1. The vulnerability allows attackers to inject malicious scripts into web pages generated by the module. There is no information about known exploits in the wild or vendor-provided patches in the provided data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other malicious actions depending on the context in which the Webform module is used. The exact impact depends on the deployment and usage of the Drupal Webform module.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Drupal's official security advisories for updates and apply patches promptly once available.