Executive brief
A security vulnerability exists in the Orejime module for Drupal, which is used to manage user consent for cookies and embedded content like iframes. An attacker with the ability to create or edit content on the site could inject malicious scripts that execute in the browsers of other users. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
A cross-site scripting (XSS) vulnerability exists in the Drupal Orejime module due to improper neutralization of input during web page generation. Specifically, the IframeConsent element writes HTML attributes without properly escaping their values. An attacker with permissions to create or modify content using a text format that allows <iframe-consent> tags can inject malicious JavaScript. The vulnerability is mitigated by the requirement that the 'Enable JS Iframe consent' option must be active and the attacker must have a role with sufficient content creation privileges. The issue is fixed in version 2.0.16.
Affected products
- Drupal Orejime 0.0.0 to < 2.0.16
Timeline
- 2026-04-08: advisory: Drupal security advisory SA-CONTRIB-2026-032 published
- 2026-05-19: disclosed: CVE-2026-6095 published to NVD
- 2026-04-08: patched: Version 2.0.16 released to address the vulnerability