Cross-Site Scripting in the WID-SEC-2026-3554 Batch: The CVE-2026-96369 Angle

CVE-2026-96369 is a high-risk cross-site scripting vulnerability affecting sixteen contributed Drupal projects, as detailed in CERT-BUND advisory WID-SEC-2026-3554. The advisory, published on 23 September 2026, assigns a CVSS v3.1 base score of 98 and a temporal score of 85. Cross-site scripting is the most commonly dismissed issue on Drupal sites, but this bulletin emphasizes its importance.

The vulnerability stems from a lack of adequate escaping when rendering user-controlled content within the Drupal request cycle. An attacker exploiting this flaw could achieve arbitrary code execution, privilege escalation, security bypass, data manipulation and disclosure, among other outcomes. However, the advisory does not specify the exact mechanism involved.

The impact of a successful exploit is highly dependent on the specific project being targeted, as session cookies for administrative users provide a significant advantage to attackers. Sites utilizing the affected modules, such as Webform, Webform REST, Cloud, Commerce Decoupled Checkout, Mermaid Diagram Field, CookieCuttr, REST & JSON API Authentication, Stop administrator login, Tawk.to Live chat application, AI CKEditor, Combined image style, CSS Usage Analyzer, and Smart Content, must prioritize updating to the fixed releases listed in the advisory.

In cases where updating is not feasible, removal of the module should be considered, and its functionality assessed to determine if it is in use. Implementing additional security measures, such as Content Security Policy, HttpOnly and SameSite attributes on session cookies, can help mitigate the risk of exploitation while patches are being developed and deployed.