Responsive Favicons CVE-2026-3218

The real-world risk of this vulnerability is moderate to high despite the absence of a CVSS numerical score. The attack vector is network-based and likely requires minimal privileges (typical for XSS in web applications), making it relatively accessible to attackers. The lack of a published CVSS vector and EPSS probability score suggests this may be a recently disclosed or coordinated vulnerability disclosure. However, the existence of an official Drupal security advisory (SA-CONTRIB-2026-019) and EUVD assignment confirms this is not a low-severity issue. The vulnerability affects all installations running Responsive Favicons prior to version 2.0.2, and because it is an XSS flaw in a contributed module, the impact depends on the target site's configuration and the presence of mitigating controls (e.g., Content Security Policy headers). Sites relying on this module for favicon management represent an attack surface for session hijacking, credential theft, or malware injection. The availability of a patch (version 2.0.2) reduces urgency but does not eliminate risk for unpatched instances.

An attacker identifies a Drupal site running an unpatched version of Responsive Favicons and injects malicious JavaScript through a favicon URL or configuration parameter. When site visitors access any page where the favicon is rendered (typically all pages), the injected JavaScript executes in their browsers with the privileges of the visited site, allowing the attacker to steal session cookies, perform actions on behalf of the user, or redirect to a phishing page. Because favicon processing occurs early in page load and is often overlooked in security reviews, this attack may persist undetected until patching is applied.