Drupal Webform contains an improper neutralization of user input during page rendering that lets an attacker inject JavaScript that executes in the victim’s browser. The flaw directly allows arbitrary script execution when a user accesses a form page with malicious input.

The vulnerability affects the Drupal Webform module for all releases from 0.0.0 through 6.2.12 and from 6.3.0 through 6.3.1. Sites running any of these releases have a Webform component that can be exploited.

Exploitation requires an attacker to supply a malicious payload through a Webform field; the payload is then rendered in the response and executed in the user’s browser. The CVSS score of 4.6 indicates a moderate risk, while the EPSS score of <1% suggests a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Sites running the affected module versions remain at risk.