The Drupal Colorbox module has an improper neutralization of input during web page generation, classified as CWE-79. This flaw allows an attacker to inject arbitrary HTML or JavaScript that is rendered by the module, leading to cross‑site scripting when other site users view the affected content. The description stresses that attacker input is not sanitized, thus the vulnerability can be exploited by any attacker who can supply input that the module renders.

Drupal sites that use the Colorbox module in any released version from the initial build (0.0.0) through 2.1.5 and from 0.0.0 through 2.2.0. Installations running Colorbox versions above 2.2.0 are not affected.

The CVSS base score of 5.4 indicates a moderate severity level. The EPSS score of < 1% reflects a very low but nonzero likelihood of exploitation, and the vulnerability is not included in the CISA KEV catalog. The attack vector is inferred to be a typical XSS path: an attacker supplies malicious input via user‑controlled fields or URL parameters that the Colorbox module processes and then renders without proper escaping.