The vulnerability is an improper neutralization of user input during web page generation, allowing an attacker to inject malicious script into a Drupal site that uses the Responsive Favicons module. A successful payload could cause a victim’s browser to execute attacker‑controlled code, potentially leading to theft of credentials, session hijacking or defacement. The weakness is a classic XSS flaw, scored CVSS 4.8, indicating moderate severity.

Drupal users running the Responsive Favicons module in any version before 2.0.2 are affected. This includes all installations that have not yet upgraded from the initial release 0.0.0 to the patched 2.0.2 release.

The EPSS score is below 1%, implying a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would typically target victims by delivering a crafted favicon request or embedding malicious parameters in a URL that the module processes for rendering. No special privileges are required; the flaw operates in the context of the web application itself. The risk to a site depends on how exposed the module’s input is to untrusted users, but the overall threat level remains moderate.