SA-CONTRIB-2026-155: Critical severity drupal/webform vulnerability
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently sanitize text counter configuration before passing options to the bundled jQuery Text Counter library. Under certain configurations, this can allow markup from counter-related settings to be inserted into the page leading to a cross-site scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must be able to create or edit affected Webform elements, or place specially crafted counter markup on a page where the Webform counter JavaScript is active.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/webformto a version that resolves this vulnerability.Fixed in 6.2.12Fixed in 6.3.1
Event History
Frequently Asked Questions
Who can realistically exploit this vulnerability?
An attacker must be able to create or edit affected Webform elements, or be able to place specially crafted counter markup on a page where the Webform counter JavaScript is active. Users without either capability are not positioned to exploit it directly.
Are all Webform deployments affected by default?
The issue occurs under certain text counter configurations and requires counter-related settings or crafted counter markup to be inserted into a page where the counter JavaScript runs. The provided information does not establish that every default Webform configuration is affected.
What should be reviewed while a fix is pending?
Review who can create or edit Webform elements and who can place markup on pages that load the Webform counter JavaScript. Restrict those capabilities where possible, and review text counter configuration for untrusted or unexpected markup.