EUVD-2026-30988
GHSA-rg7p-g694-c73p
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (drupal) · only source for this CVE.
CVSS VectorVendor: drupal
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS).
This issue affects Obfuscate: from 0.0.0 before 2.0.2.
AnalysisAI
Cross-site scripting in the Drupal Obfuscate contributed module (versions 0.0.0 through before 2.0.2) allows remote unauthenticated attackers to inject malicious scripts into pages rendered for other users, with impact scoped across security boundaries (S:C). The vulnerability stems from improper neutralization of input during web page generation, enabling session hijacking or UI redress attacks against users who view attacker-controlled content processed by the module. No public exploit has been identified at time of analysis, and EPSS at 0.03% (8th percentile) reflects low current exploitation probability.
Technical ContextAI
The affected component is the Drupal Obfuscate contributed module (CPE: cpe:2.3:a:drupal:obfuscate:*:*:*:*:*:*:*:*), a Drupal add-on typically used to obfuscate sensitive content such as email addresses or phone numbers to deter scraping. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input passed through this module is insufficiently sanitized or encoded before being embedded into HTML output. When rendered in a victim's browser, injected script payloads execute within the page's origin context. The changed scope flag (S:C) in the CVSS vector indicates the vulnerability's impact extends beyond the Obfuscate module itself - for example, into the broader Drupal session or parent browser context.
RemediationAI
Update the Drupal Obfuscate module to version 2.0.2 or later, as confirmed by the vendor patch available through Drupal Security Advisory SA-CONTRIB-2026-033 (https://www.drupal.org/sa-contrib-2026-033). Administrators can apply the update via the Drupal admin interface under Extend > Update or using Drush with the command 'drush pm:update obfuscate'. If an immediate update is not feasible, disabling the Obfuscate module entirely is an effective compensating control that removes the attack surface; the trade-off is loss of content obfuscation functionality until the patch can be applied. Additionally, tightening content submission permissions to restrict untrusted or anonymous users from submitting input processed by the module can reduce exposure in the interim, though this does not constitute a fix.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today