Executive brief
The Webform module for Drupal allows site builders to create online forms and collect user submissions. A cross-site scripting vulnerability exists in the text counter configuration feature, which fails to properly sanitize markup before passing it to a JavaScript library. An attacker who can create or edit webforms could inject malicious scripts that execute in the browsers of users viewing those forms.
Technical details
The vulnerability exists in insufficient sanitization of text counter configuration options before passing them to the bundled jQuery Text Counter library, allowing unsanitized markup to reach the client-side JavaScript. The attack requires elevated privileges (ability to create or edit Webform elements) or placement of specially crafted counter markup on a page where the Webform counter JavaScript is active. A successful exploit results in cross-site scripting execution within the context of the affected page.
Affected products
- Drupal Webform <6.2.12 or >=6.3.0 <6.3.1
Timeline
- 2026-09-23: disclosed
- 2026-09-23: patched: versions 6.2.12 and 6.3.1 available