September 2026 - Security-news

CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-181 Project: CookieCuttr [1] Project machine name: cookiecuttr Date: 2026-September-23 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: >=2.0.0 <2.0.3 CVE IDs: CVE-2026-96379 Description: This module enables you to provide information and options about cookie usage. The module does not sufficiently filter input submitted through the Cookiecuttr administration form. This could allow specially crafted values to be stored and later rendered without adequate sanitization, resulting in a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission /administer cookiecuttr/. Solution: Install the latest version: * Upgrade to cookiecuttr 2.0.3 [3]. Reported By: * Swan Kalata (akalata) [4] of the Drupal Security Team * Marcus Johansson (marcus_johansson) [5] Fixed By: * Malcolm Young (malcomio) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/cookiecuttr [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/cookiecuttr/releases/2.0.3 [4] https://www.drupal.org/u/akalata [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/malcomio [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/xjm [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-180 Project: Mermaid Diagram Field [1] Project machine name: mermaid_diagram_field Date: 2026-September-23 Security risk: *Moderately critical* 13 ∕ 25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: >=1.0.4 <1.0.9 CVE IDs: CVE-2026-96384 Description: This module enables you to add mermaid diagram that displays either inline on an entity or optionally in a modal. The module doesn't sufficiently respect default revision behavior and does not properly limit access to the modal content. This vulnerability is mitigated by the fact that an attacker must have the modal display option enabled for the field, or otherwise know the route of the modal and entity ID. Solution: Install the latest version: * If you use the Mermaid Diagram Field module, upgrade to Mermaid Diagram Field 1.0.10 [3]. Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Steve Wirt (swirt) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/mermaid_diagram_field [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/mermaid_diagram_field/releases/1.0.10 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/swirt [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/xjm [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-179 Project: Commerce Decoupled Checkout [1] Project machine name: commerce_decoupled_checkout Date: 2026-September-23 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: >=1.0.0 <1.8.0 CVE IDs: CVE-2026-96378 Description: This module enables REST endpoints for a decoupled Commerce experience which allow for remote order creation. The module doesn't sufficiently sanitize order data passed into the order creation endpoint, which allows for potentially unsafe order properties to be set on an order. Solution: Install the latest version of the module: * Update to Commerce Decoupled Checkout 8.x-1.8 [3]. The standard order fields type, email, store, and order_items remain accepted by default. Sites submitting additional custom order fields must explicitly enable them at /admin/commerce/config/decoupled-checkout. Requests containing fields outside this allowlist will be rejected. Run database updates and configure the required customer-writable fields before resuming checkout. Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Leo Pitt (leo pitt) [5] * Marcus Johansson (marcus_johansson) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/commerce_decoupled_checkout [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce_decoupled_checkout/releases/8.x-1.8 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/leo-pitt [6] https://www.drupal.org/u/marcus_johansson [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/xjm [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-178 Project: Project Browser [1] Project machine name: project_browser Date: 2026-September-23 Security risk: *Critical* 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site request forgery Affected versions: <2.0.3 || >=2.1.0 <2.1.5 CVE IDs: CVE-2026-96374 Description: The Project Browser module enables you to apply recipes and enable modules from the web user interface. The module doesn't sufficiently validate admin actions to protect against cross-site request forgery attacks (CSRF). Solution: Install the latest version: * If you use the 2.1.x branch, upgrade to Project Browser 2.1.5 [3]. * If you use the 2.0.x branch, upgrade to Project Browser 2.0.3 [4]. Reported By: * Tin Nguyen Huu (s4m0y3d) [5] Fixed By: * Chris Wells (chrisfromredfin) [6] * Tin Nguyen Huu (s4m0y3d) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Bram Driesen (bramdriesen) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Drew Webber (mcdruid) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/project_browser [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/project_browser/releases/2.1.5 [4] https://www.drupal.org/project/project_browser/releases/2.0.3 [5] https://www.drupal.org/u/s4m0y3d [6] https://www.drupal.org/u/chrisfromredfin [7] https://www.drupal.org/u/s4m0y3d [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/bramdriesen [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/mcdruid [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-177 Project: Cloud [1] Project machine name: cloud Date: 2026-September-23 Security risk: *Critical* 15 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Remote code execution Affected versions: <7.0.1 CVE IDs: CVE-2026-96376 Description: The Cloud module enables users to manage cloud resources through Drupal. The module does not sufficiently sanitize user-controlled Git branch and repository URL values before passing them to shell commands in the Kubernetes integration. This vulnerability allows an attacker to execute arbitrary operating-system commands as the web-server user. This vulnerability is mitigated by the fact that the Kubernetes submodule must be enabled and configured, Git must be available on the server, and an attacker must have permission to add or edit cloud server templates. Exploiting the clone path additionally requires the "launch cloud server template" permission, or the "launch approved cloud server template" permission when using the approved-template flow. Solution: Install the latest version: * If you use Cloud 7.x, upgrade to Cloud 7.0.1 [3]. Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * AI Yas (ai_yas) [5] * Drew Webber (mcdruid) [6] of the Drupal Security Team * Yas Naoi (yas) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/cloud [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/cloud/releases/7.0.1 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/ai_yas [6] https://www.drupal.org/u/mcdruid [7] https://www.drupal.org/u/yas [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-176 Project: Cloud [1] Project machine name: cloud Date: 2026-September-23 Security risk: *Critical* 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Remote code execution Affected versions: <7.0.1 CVE IDs: CVE-2026-96375 Description: The Cloud module enables users to manage cloud infrastructure through Drupal. The Kubernetes and VMware integrations do not properly validate TLS certificates when connecting to remote API endpoints. An attacker who can intercept these connections may obtain secret tokens or other credentials, potentially allowing unauthorized access to the connected infrastructure. Solution: If you use Cloud, install the latest version and configure certificates appropriately: * If you use the 7.0.0 branch, update to 7.0.1 [3]. The update enables TLS certificate verification for Kubernetes and VMware connections. Sites using a private certificate authority must configure the CA certificate path for the affected connection or ensure that the issuing CA is trusted by the PHP runtime. Run the Drupal database updates and rebuild caches after upgrading. Reported By: * Kalle Kipinä (kekkis) [4] Fixed By: * AI Yas (ai_yas) [5] * baldwinlouie [6] * Yas Naoi (yas) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/cloud [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/cloud/releases/7.0.1 [4] https://www.drupal.org/u/kekkis [5] https://www.drupal.org/u/ai_yas [6] https://www.drupal.org/u/baldwinlouie [7] https://www.drupal.org/u/yas [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-172 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96357 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include uploaded files. The module does not sufficiently force certain uploaded file types to download when served. Under certan site configurations, a file uploaded through a webform could be rendered inline by a browser, resulting in a cross-site scripting vulnerability. This vulnerability is mitigated by the fact that a user with permission to create or edit webforms must configure the form to allow the affected file extensions, and a user must specifically open the uploaded file. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. Reported By: * Michael Maturi (michaelmaturi) [5] Fixed By: * Jacob Rockowitz (jrockowitz) [6] * Lee Rowlands (larowlan) [7] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Bram Driesen (bramdriesen) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/michaelmaturi [6] https://www.drupal.org/u/jrockowitz [7] https://www.drupal.org/u/larowlan [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/bramdriesen [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-158 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96358 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a rating element, which did not sufficiently validate its data. Under specific circumstances, this could allow cross-site scripting on a page with a rating element. This vulnerability is mitigated by the fact that an attacker must be able to place crafted HTML markup on the same page as a Webform rating element. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. Reported By: * Pierre Rudloff (prudloff) [5] of the Drupal Security Team Fixed By: * Jacob Rockowitz (jrockowitz) [6] * Lee Rowlands (larowlan) [7] of the Drupal Security Team * Pierre Rudloff (prudloff) [8] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Bram Driesen (bramdriesen) [10] of the Drupal Security Team * Neil Drumm (drumm) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/jrockowitz [7] https://www.drupal.org/u/larowlan [8] https://www.drupal.org/u/prudloff [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/bramdriesen [11] https://www.drupal.org/u/drumm [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-159 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96359 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module did not sufficiently sanitize attributes used by its color element. Under certain conditions, specially crafted attributes could result in cross-site scripting (XSS) when the element is rendered. This vulnerability is mitigated by the fact that an attacker must be able to add a specially crafted link with a specific class to the same page as the affected webform. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. Reported By: * Pierre Rudloff (prudloff) [5] of the Drupal Security Team Fixed By: * Jacob Rockowitz (jrockowitz) [6] * Lee Rowlands (larowlan) [7] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Bram Driesen (bramdriesen) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Pierre Rudloff (prudloff) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/jrockowitz [7] https://www.drupal.org/u/larowlan [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/bramdriesen [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/prudloff [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154
by security-news＠drupal.org 23 Sep '26

23 Sep '26

View online: https://www.drupal.org/sa-contrib-2026-154 Project: Webform [1] Project machine name: webform Date: 2026-September-23 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96360 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module provides JavaScript behaviours for announcing dynamic form updates to assistive technologies. In some configurations, due to improper sanitisation, specially crafted announcement text could create a cross-site scripting risk for users interacting with the affected Webform. Solution: Install the latest version: * If you use the 6.2.x branch of Webform upgrade to Webform 6.2.12 [3]. * If you use the 6.3.x branch of Webform, upgrade to Webform 6.3.1 [4]. Reported By: * Pierre Rudloff (prudloff) [5] of the Drupal Security Team Fixed By: * Jacob Rockowitz (jrockowitz) [6] * Lee Rowlands (larowlan) [7] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Bram Driesen (bramdriesen) [9] of the Drupal Security Team * Pierre Rudloff (prudloff) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/6.2.12 [4] https://www.drupal.org/project/webform/releases/6.3.1 [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/jrockowitz [7] https://www.drupal.org/u/larowlan [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/bramdriesen [10] https://www.drupal.org/u/prudloff [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0