Find a vulnerability

{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c6.2.12 || \u003e=6.3.0 \u003c6.3.1"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/webform"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c6.2.12"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.2.12"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "database_specific": {
            "constraint": "\u003e=6.3.0 \u003c6.3.1"
          },
          "events": [
            {
              "introduced": "6.3.0"
            },
            {
              "fixed": "6.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-96360"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/prudloff"
      ],
      "name": "Pierre Rudloff (prudloff)"
    }
  ],
  "details": "The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.\n\nThe module provides JavaScript behaviours for announcing dynamic form updates to assistive technologies.\n\nIn some configurations, due to improper sanitisation, specially crafted announcement text could create a cross-site scripting risk for users interacting with the affected Webform.",
  "id": "DRUPAL-CONTRIB-2026-154",
  "modified": "2026-09-23T16:47:02.000Z",
  "published": "2026-09-23T16:11:28.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-154"
    }
  ],
  "schema_version": "1.7.0"
}