Drupal Obfuscate CVE-2026-6871

Exploitation requires that the target Drupal site has the Obfuscate contributed module installed and enabled at a version between 0.0.0 and before 2.0.2. The CVSS vector (PR:N) confirms no authentication is needed to submit the malicious payload; however, user interaction (UI:R) is required - a victim must navigate to and render the page containing the injected content for the XSS to execute. Exploitation is therefore limited by: (1) the Obfuscate module must be present and active on the target site, (2) the attacker must be able to submit input processed by the module (e.g., via a public-facing content form), and (3) a user - ideally one with elevated session privileges - must view the affected page. Sites that restrict content submission to authenticated, trusted roles significantly reduce their exposure even before patching.

The CVSS 6.1 medium score reflects a network-reachable (AV:N), low-complexity (AC:L), no-privilege-required (PR:N) vulnerability that still demands user interaction (UI:R) to trigger, limiting opportunistic mass exploitation. The changed scope (S:C) elevates impact beyond what the base confidentiality and integrity scores (both Low) might suggest in isolation, as cross-origin script execution can facilitate session token theft against privileged users. EPSS at 0.03% (8th percentile) corroborates low real-world exploitation activity at time of analysis - this is not being actively targeted by automated or widespread campaigns. There is no CISA KEV listing and no known public exploit code, further reducing urgency. In practice, this is a genuine but non-critical risk: sites running the Obfuscate module with public content submission should patch promptly, but there is no evidence of active exploitation warranting emergency response.

An attacker submits a content item (such as a node or field value) containing a crafted XSS payload through a publicly accessible form on a Drupal site running the vulnerable Obfuscate module. When an authenticated user - such as a site administrator or editor - navigates to a page that renders the obfuscated content, the injected script executes in their browser, potentially exfiltrating their session cookie or performing administrative actions on their behalf. No public exploit code has been identified, but the low attack complexity (AC:L) and absence of privilege requirements (PR:N) make this straightforward to reproduce manually.