PatchClock

PHP security digest · 23 Sep 2026

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module provides JavaScript...

Unrated CVE-2026-96360

Package
drupal/webform
Fixed in
6.2.12, 6.3.1
Published
Wed 23 Sep 2026, 17:11 LisbonUpdated Mon 26 Oct 2026, 02:26 Lisbon

In plain words

Improper sanitisation of Webform announcement text can allow cross-site scripting against users interacting with an affected form. This concerns JavaScript announcements of dynamic form updates to assistive technologies, and occurs only in some configurations.

Am I affected?

Look for drupal/webform and its version in composer.lock. The advisory lists 6.2.12 and 6.3.1 as fixed versions but gives no affected version range. Check whether your forms use JavaScript announcements of dynamic updates to assistive technologies; the advisory does not specify which configurations are affected.

What to do

Check which version you have, then update to a fixed release for your branch (6.2.12, 6.3.1):

composer show drupal/webform | grep versions
composer update drupal/webform

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

The module provides JavaScript behaviours for announcing dynamic form updates to assistive technologies.

In some configurations, due to improper sanitisation, specially crafted announcement text could create a cross-site scripting risk for users interacting with the affected Webform.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.