CVE-2026-96355

Name of the Vulnerable Software and Affected Versions Drupal (affected versions not specified)

Description The Webform module fails to sufficiently exclude certain format templates from token replacement. This allows an attacker to submit data that is evaluated as template code during the rendering of a submission. Depending on the site configuration and enabled modules, this can result in remote code execution, stored cross-site scripting (XSS), or information disclosure. This issue is mitigated if the webform is not configured with a custom multiple-value item format that includes submission-value tokens. Approximately 436,300 instances were identified globally.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.