Drupal Orejime <=2.0.16 XSS via improper input neutralization
CVE-2026-6095 Published on May 19, 2026
Orejime - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-032
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime allows Cross-Site Scripting (XSS).
This issue affects Orejime: from 0.0.0 before 2.0.16.
Vulnerability Analysis
CVE-2026-6095 can be exploited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-6095 has been classified to as a XSS vulnerability or weakness.
Affected Versions
Drupal Orejime:- Version 0.0.0 and below 2.0.16 is affected.