CVE-2026-96359

Name of the Vulnerable Software and Affected Versions Webform (affected versions not specified)

Description The Webform module fails to sufficiently sanitize attributes used by its color element. This can lead to cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites, when the element is rendered. Exploitation requires the attacker to add a specially crafted link with a specific class to the same page as the affected webform. Approximately 436,400 instances of Drupal were identified globally as potential targets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.