Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows… (CVE-2026-16640)

CVE-2026-16640 describes a reflected Cross-site Scripting (XSS) vulnerability in the Drupal Search API Autocomplete module. The issue arises from improper neutralization of input during web page generation, which can be exploited to execute arbitrary scripts in the context of a user's browser. This affects all versions from the initial release (0.0.0) up to version 1.12.0. The CVSS 3.1 base score is 6.1, indicating a medium severity vulnerability with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality and integrity but not availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure or manipulation of web content. The vulnerability impacts confidentiality and integrity but does not affect availability. No known exploits are reported in the wild at this time.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, users should exercise caution with untrusted input and consider disabling or restricting the vulnerable module if feasible.