{"id":"CVE-2026-96355","published":"2026-10-22T02:17:05.433","lastModified":"2026-10-23T04:18:23.770","description":"Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-1336"],"vendors":[],"products":[],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-175","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Drupal Webform module before 6.2.13 and 6.3.2 contains a code injection flaw (CWE-1336) where unsanitized user input in templates can execute arbitrary server-side code, leading to full compromise of confidentiality and integrity.","exploitability":"Exploitation is straightforward for remote attackers with access to the Webform module's template features; no authentication or user interaction is required.","blast_radius":"Successful exploitation allows attackers to read sensitive data and modify system files or application logic, potentially affecting all sites running vulnerable Webform versions.","remediation":"Upgrade to Webform version 6.2.13 or 6.3.2 immediately.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["code-injection","template-engine","drupal","webform","cwe-1336"],"model":"garnet-coder","analyzedAt":"2026-10-26T08:51:14.019Z"}}