Executive brief
The Drupal Search API Autocomplete module is a popular plugin that enables autocomplete suggestions on search forms. A test script included in the module is accessible to anonymous users and fails to properly validate user input, allowing attackers to inject malicious JavaScript code. An attacker could exploit this to steal user session cookies, perform actions on behalf of authenticated users, or redirect users to malicious websites.
Technical details
This is a reflected cross-site scripting (XSS) vulnerability in the Search API Autocomplete module's test script. The vulnerable component fails to sanitize user-supplied input before rendering it in the HTML response, allowing an attacker to inject arbitrary JavaScript. The attack is network-accessible and requires no authentication; an attacker can craft a malicious URL and trick users into clicking it. Successful exploitation allows arbitrary JavaScript execution in the victim's browser within the context of the affected website. The vulnerability affects all versions prior to 1.12.0 and is fixed in version 1.12.0 or later. A temporary mitigation involves disabling PHP error display via the display_errors setting.
Affected products
- Drupal Search API Autocomplete 0.0.0 to 1.11.x
Timeline
- 2026-07-22: disclosed
- 2026-07-22: patched: Version 1.12 released