Executive brief
The Webform module for Drupal allows site builders to create forms and send submissions to remote servers. A cross-site scripting vulnerability exists when a site displays responses from remote endpoints without proper filtering. An attacker who controls the remote endpoint can inject malicious code that executes in users' browsers, potentially stealing session data or credentials.
Technical details
The Webform module fails to sanitize response values from Remote Post handlers before rendering them through handler response tokens. The vulnerability requires an attacker to control or influence the response from a configured remote API endpoint, and the site must use those response tokens in rendered output. XSS injection in rendered HTML is the result; the vulnerability is fixed in versions 6.2.12 and 6.3.1.
Affected products
- Drupal Webform before 6.2.12, 6.3.0 to 6.3.0
Timeline
- 2026-09-23: disclosed
- 2026-09-23: patched: Patched in versions 6.2.12 and 6.3.1