Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. (CVE-2026-96355)

CVE-2026-96355 is a code injection vulnerability in the Drupal Webform module caused by improper neutralization of special elements in its template engine. This flaw enables an attacker to inject and execute arbitrary code remotely without authentication or user interaction. The vulnerability affects Webform versions from the initial release through 6.2.12 and also versions 6.3.0 and 6.3.1. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Successful exploitation allows remote attackers to execute arbitrary code on affected Drupal Webform installations, compromising confidentiality and integrity of the system. There is no indication of impact on availability. The vulnerability does not require privileges or user interaction, increasing its severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the Webform module and monitor for suspicious activity related to template processing.