{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/webform-0.0.0-6.2.12-6.3.0-6.3.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-96355"},{"id":"CVE-2026-96365"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Webform (0.0.0-6.2.12, 6.3.0-6.3.1)","Webform (versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1)"],"_cs_severities":["critical"],"_cs_tags":["web-application","drupal","cve-2026-96365"],"_cs_type":"advisory","_cs_vendors":["Drupal"],"content_html":"\u003cp\u003eDrupal Webform is affected by a vulnerability identified as CVE-2026-96355. This issue involves the improper neutralization of special elements within the module's template engine, resulting in Code Injection. This vulnerability affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.\u003c/p\u003e\n","date_modified":"2026-10-22T18:15:30Z","date_published":"2026-10-22T16:14:42Z","id":"https://feed.craftedsignal.io/briefs/2026-10-drupal-webform-code-injection/","summary":"The Drupal Webform module is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability, which allows for Code Injection.","title":"Drupal Webform: Code injection via template engine (CVE-2026-96355)","url":"https://feed.craftedsignal.io/briefs/2026-10-drupal-webform-code-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Webform (0.0.0-6.2.12, 6.3.0-6.3.1)","version":"https://jsonfeed.org/version/1.1"}