Improper neutralization of input in the Drupal Obfuscate module allows attackers to inject malicious scripts into web pages that visitors load. This cross‑site scripting flaw gives an attacker the ability to run arbitrary JavaScript in the context of authenticated or unauthenticated users, potentially leading to credential theft, session hijacking, or defacement of the site. The vulnerability is rated as moderately critical by the CNA.

All releases of the Obfuscate module from its initial 0.0.0 version up to, but not including, 2.0.2 are affected. This includes every pre‑2.0.2 build shipped by Drupal. No other product or vendor is impacted according to the available data.

The CVSS score is 6.1, but the CNA describes it as moderately critical, and the EPSS score is 0.00029, indicating a very low probability of exploitation. It is not listed in the CISA KEV catalog. The attack vector is inferred to be remote through the web interface that processes user input via the module. With no publicly disclosed exploit code, the likelihood of exploitation remains uncertain, but the flaw permits arbitrary client‑side code execution if an attacker can supply crafted input.