Drupal Webform implements a content sanitization flaw that permits a malicious user to inject arbitrary JavaScript into a page rendered by the module. The flaw arises from inadequate neutralization of user supplied input, allowing attackers to embed scripts that execute in any browser that loads the affected form. An attacker could deface web pages, capture session cookies, or run client‑side commands that could facilitate further social engineering or credential theft. The vulnerability is identified as a moderate‑critical cross‑site scripting issue.

The affected product is the Drupal Webform module, maintained by the Drupal community. All installations of Webform from version 0.0.0 through 6.2.12, and from 6.3.0 through 6.3.1, are vulnerable. No newer releases beyond 6.3.1 are included in the impact scope, while versions prior to 0.0.0 or beyond 6.3.1 exhibit no known issue.

The attack vector is client‑side; an attacker can submit crafted input through any form field or URL that ultimately renders on a public web page. No authentication or elevated privileges are required. Because the vulnerability relies on a widely known script injection pattern and is non‑sophisticated, exploitability is considered high in environments where user input is not further sanitized. The EPSS score is < 1%, indicating a very low probability of exploitation. The CVSS score is 4.6, reflecting moderate severity. The vulnerability does not appear in the CISA KEV catalog. The community has labeled the issue as moderately critical, suggesting that the threat is significant enough to warrant prompt attention.