CVE-2026-96379: CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Drupal CookieCuttr

CVE-2026-96379 describes a stored cross-site scripting vulnerability in the Drupal CookieCuttr module. The flaw arises from improper input sanitization during web page generation, classified under CWE-79. Versions from 2.0.0 up to but not including 2.0.3 are affected. No CVSS score or detailed vendor advisory is provided, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to inject malicious scripts that execute in the context of users' browsers, potentially leading to session hijacking, defacement, or other client-side attacks. However, no active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor Drupal's official channels for updates or patches addressing this vulnerability. Until a fix is available, consider disabling or restricting use of the affected CookieCuttr versions if feasible.