—

DRUPAL-CONTRIB-2026-154

Details

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

The module provides JavaScript behaviours for announcing dynamic form updates to assistive technologies.

In some configurations, due to improper sanitisation, specially crafted announcement text could create a cross-site scripting risk for users interacting with the affected Webform.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist:https://packages.drupal.org/8/drupal/webform

Introduced in: 0Fixed in: 6.2.12

Upgrade drupal/webform to 6.2.12 or newer (ecosystem packagist:https://packages.drupal.org/8).

References

https://www.drupal.org/sa-contrib-2026-154[WEB]