EUVD-2026-43048
GHSA-fhcj-f666-rhjr
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Reflected XSS is network-delivered without privileges (AV:N/PR:N), requires victim to load crafted URL (UI:R), and executes in the browser security context crossing scope boundary (S:C) with bounded C/I impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This issue affects Anti-Spam by CleanTalk versions: from 0.0.0 to 9.7.1.
AnalysisAI
Reflected XSS in the Anti-Spam by CleanTalk Drupal contributed module (versions 0.0.0 through 9.7.1) allows remote unauthenticated attackers to inject and execute malicious JavaScript in a victim's browser by tricking them into visiting a crafted URL. The CVSS Changed scope (S:C) confirms the payload executes in the browser's security context, enabling session theft, credential harvesting, or UI redirection against authenticated Drupal users. No public exploit code and no active exploitation have been identified; EPSS at 0.16% (6th percentile) indicates negligible observed exploitation probability at time of analysis.
Technical ContextAI
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the reflected variant where attacker-supplied input - typically a URL query parameter - is embedded into an HTTP response without adequate output encoding. The affected component is the Anti-Spam by CleanTalk contributed module for Drupal, identified by CPE cpe:2.3:a:drupal:anti-spam_by_cleantalk:*:*:*:*:*:*:*:*, distinguishing it from the broader CleanTalk SaaS service. Drupal's contributed module ecosystem runs as server-side PHP; reflected XSS in this context most commonly arises in form validation feedback paths or admin-facing reporting surfaces that echo request parameters. The CVSS scope flag S:C signals the injection crosses from the Drupal application boundary into the victim's browser security context, which is the defining characteristic of XSS impact.
RemediationAI
The primary remediation is to upgrade the Anti-Spam by CleanTalk Drupal module to version 9.7.1 or later, which contains the vendor-released fix per Drupal Security Advisory sa-contrib-2026-042 (https://www.drupal.org/sa-contrib-2026-042). The upgrade can be performed via Drupal's standard update path (drush up or the admin UI). If immediate patching is not feasible, disabling the Anti-Spam by CleanTalk module entirely removes the vulnerable attack surface with the trade-off of losing anti-spam coverage, requiring a temporary alternative such as CAPTCHA or another anti-spam plugin. As a partial mitigation, deploying or tightening a Content Security Policy header to restrict inline script execution (script-src 'self') reduces the exploitability of any residual XSS surface, though it does not remediate the underlying flaw. Web Application Firewall XSS rule sets may provide opportunistic blocking but are not reliable as a sole control against reflected XSS.
More in Anti Spam By Cleantalk
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today