Is CVE-2026-10770 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10770 being exploited in the wild.

How severe is CVE-2026-10770?

Informational severity, with a CVSS score of 4.2, published 10 July 2026.

Which products and versions are affected?

CleanTalk Anti-Spam by CleanTalk 0.0.0 to 9.7.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/Cleantalk ECOSYSTEM:introduced=0,fixed=9.7.1.

Is there a fix for CVE-2026-10770?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Cleantalk: upgrade to 9.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10770 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-10770?

Check whether you run CleanTalk Anti-Spam by CleanTalk or Packagist:Https://Packages.Drupal.Org/8 Drupal/Cleantalk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10770: Drupal Anti-Spam by CleanTalk reflected XSS in API response handling

CVE-2026-10770 · Severity: info · CVSS 4.2 · Published 2026-07-10

The Anti-Spam by CleanTalk module for Drupal, which protects websites from automated spam and bot registrations, contains a security flaw. An attacker who can intercept or manipulate the communication between the website and the CleanTalk cloud service could inject malicious scripts into the site's administrative interface. This could lead to unauthorized actions being performed in the context of a site administrator's session.

Technologies: Packagist:Https://Packages.Drupal.Org/8 Drupal/Cleantalk. Vendors: CleanTalk, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-10770 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10770 being exploited in the wild.
How severe is CVE-2026-10770?: Informational severity, with a CVSS score of 4.2, published 10 July 2026.
Which products and versions are affected?: CleanTalk Anti-Spam by CleanTalk 0.0.0 to 9.7.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/Cleantalk ECOSYSTEM:introduced=0,fixed=9.7.1.
Is there a fix for CVE-2026-10770?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Cleantalk: upgrade to 9.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10770 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-10770?: Check whether you run CleanTalk Anti-Spam by CleanTalk or Packagist:Https://Packages.Drupal.Org/8 Drupal/Cleantalk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Cleantalk: upgrade to 9.7.1 or later

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the Anti-Spam by CleanTalk module for Drupal. The vulnerability is located within the _cleantalk_die() and ct_die() functions, which fail to properly sanitize messages received from the CleanTalk cloud API before rendering them in HTML output. An attacker could exploit this by influencing the API response, for example via a man-in-the-middle (MitM) attack or by compromising the upstream API server, to execute arbitrary JavaScript in the victim's browser. The issue is fixed in version 9.7.1.

Affected products

Drupal Anti-Spam by CleanTalk 0.0.0 to 9.7.0

Identifiers

CVE-2026-10770
DRUPAL-CONTRIB-2026-042

Timeline

2026-06-03: advisory: Drupal security advisory SA-CONTRIB-2026-042 published
2026-06-16: patched: Version 9.7.2 released (9.7.1 contained the fix)
2026-07-10: disclosed: CVE-2026-10770 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.