SA-CONTRIB-2026-159: XSS
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module did not sufficiently sanitize attributes used by its color element. Under certain conditions, specially crafted attributes could result in cross-site scripting (XSS) when the element is rendered. This vulnerability is mitigated by the fact that an attacker must be able to add a specially crafted link with a specific class to the same page as the affected webform.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/webformto a version that resolves this vulnerability.Fixed in 6.2.12Fixed in 6.3.1
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
The attacker must be able to add a specially crafted link with a specific class to the same page as an affected webform. The crafted attributes are then rendered through the Webform color element.
Who is realistically exposed?
Sites using the Drupal Webform module are exposed where an attacker can place a specially crafted link on a page that also contains an affected webform. The issue is mitigated when attackers cannot add such content to those pages.