{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c5.11.0"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/webform"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c5.11.0"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.11.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/user/504278"
      ],
      "name": "Dan Chadwick"
    }
  ],
  "details": "The Webform module allows site builders to create forms.\n\nThe module doesn\u0027t sufficiently prevent malicious code from being render via an options elements (i.e select menu, checkboxes, radios, etc...) under the scenario where the site builder allows the raw option value to be displayed.\n\nThis vulnerability is mitigated by the fact that site builder must be allowed to build webform and select raw as the options element\u0027s submission display.",
  "id": "DRUPAL-CONTRIB-2020-013",
  "modified": "2023-08-11T17:55:41.000Z",
  "published": "2020-05-06T16:50:39.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2020-013"
    }
  ],
  "schema_version": "1.7.0"
}