Executive brief
The Obfuscate module for Drupal, which is used to hide email addresses from automated bots, contains a security flaw. An attacker with the ability to post content could inject malicious scripts that execute in the browsers of other users. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
A cross-site scripting (XSS) vulnerability exists in the Drupal Obfuscate module due to insufficient sanitization of user input within its Twig filter. The flaw is specifically present when the module is configured to use ROT13 encoding. An attacker with permissions to submit content that is processed by this filter can inject arbitrary JavaScript. This script would then execute in the context of a victim's browser session. The issue is resolved in version 2.0.2.
Affected products
- Drupal Obfuscate 0.0.0 to 2.0.1
Timeline
- 2026-04-22: advisory: Drupal security advisory SA-CONTRIB-2026-033 published
- 2026-04-22: patched: Version 2.0.2 released to address the vulnerability
- 2026-05-19: disclosed: CVE-2026-6871 published to the NVD