{"id":"CVE-2026-96355","published":"2026-10-22T02:17:05Z","modified":"2026-10-23T04:18:23Z","title":"Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code…","vendor":"Drupal","product":"Webform","tier":"core","eol":null,"description":{"text":"Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","provenance":"source","from":"NVD"},"summary":{"text":"The vulnerability is an improper neutralization of special elements used in a template engine within the Webform component of the Drupal Webform product, which permits code injection. An attacker who can reach the affected Webform installation over the network, without authentication or any user interaction, can inject and execute code, with high impact to confidentiality and integrity.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:21:45Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.00421,"percentile":0.36442,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-1336","name":"Improper Neutralization of Special Elements Used in a Template Engine"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-175","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/webform","vulnerableRanges":["<6.2.12",">=6.3.0, <6.3.1"],"patched":["6.2.12","6.3.1"],"from":["DRUPAL-CONTRIB-2026-175"],"provenance":"source"}],"advisories":[{"id":"DRUPAL-CONTRIB-2026-175","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-175","severity":null,"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/webform","vulnerableRanges":["<6.2.12",">=6.3.0, <6.3.1"],"patched":["6.2.12","6.3.1"],"provenance":"source","from":"OSV"}],"euvd":{"id":"EUVD-2026-107826","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107826","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-22","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96355","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":13.7,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":7.29,"detail":"percentile 0.3644"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}