{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c6.2.12 || \u003e=6.3.0 \u003c6.3.1"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/webform"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c6.2.12"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.2.12"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "database_specific": {
            "constraint": "\u003e=6.3.0 \u003c6.3.1"
          },
          "events": [
            {
              "introduced": "6.3.0"
            },
            {
              "fixed": "6.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-96359"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/prudloff"
      ],
      "name": "Pierre Rudloff (prudloff)"
    }
  ],
  "details": "The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.\n\nThe module did not sufficiently sanitize attributes used by its color element. Under certain conditions, specially crafted attributes could result in cross-site scripting (XSS) when the element is rendered.\n\nThis vulnerability is mitigated by the fact that an attacker must be able to add a specially crafted link with a specific class to the same page as the affected webform.",
  "id": "DRUPAL-CONTRIB-2026-159",
  "modified": "2026-09-23T16:47:07.000Z",
  "published": "2026-09-23T16:13:50.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-159"
    }
  ],
  "schema_version": "1.7.0"
}