CVE-2026-0749 Overview
CVE-2026-0749 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Drupal Form Builder module maintained by Silence. The flaw stems from improper neutralization of user input during web page generation. Attackers with authenticated low-privilege access can inject script payloads that execute in the browsers of users who view affected pages. The vulnerability affects Drupal Form Builder versions 7.X-1.0 through 7.X-1.22. Successful exploitation requires user interaction, limiting the attack surface compared to reflected or DOM-based variants.
Critical Impact
Authenticated attackers can inject malicious JavaScript into Form Builder fields, leading to session theft, content manipulation, and unauthorized actions performed in the context of victim users.
Affected Products
- Drupal Form Builder module (Silence) 7.X-1.0 through 7.X-1.22
- Drupal 7 sites with the Form Builder contributed module enabled
- Sites where untrusted users have permissions to create or edit forms
Discovery Timeline
- 2026-01-28 - CVE-2026-0749 published to NVD
- 2026-03-09 - Last updated in NVD database
Technical Details for CVE-2026-0749
Vulnerability Analysis
The Form Builder module allows administrators and authorized users to construct Drupal forms with custom fields, labels, and descriptions. The vulnerability arises because the module fails to sanitize attacker-controlled input before rendering it into HTML output. When an authenticated user with form-creation permissions submits crafted markup, the module stores the payload and later emits it without proper encoding.
The issue is classified under CWE-79, Improper Neutralization of Input During Web Page Generation. Exploitation requires the victim to load a page containing the injected content, which qualifies as user interaction. The scope of impact is limited to confidentiality and integrity within the subsequent system, not the vulnerable component itself.
For full technical context, refer to the Tag1 Security Advisory and HeroDevs CVE-2026-0749 advisory.
Root Cause
The root cause is the absence of contextual output encoding when the Form Builder module renders user-supplied form metadata such as labels, descriptions, or option values. Drupal 7 expects modules to apply functions such as check_plain(), filter_xss(), or render arrays with #plain_text properties. Form Builder omits these sanitization steps on specific input paths, allowing raw HTML and <script> tags to reach the browser.
Attack Vector
An authenticated attacker with permission to create or modify forms inserts a JavaScript payload into a vulnerable form field. The payload is stored in the Drupal database alongside legitimate form definitions. When an administrator or another user navigates to a page that renders the affected form, the browser executes the injected script under the origin of the Drupal site. Common abuse cases include stealing session cookies, performing CSRF actions against /user/, or redirecting users to attacker-controlled domains.
No verified proof-of-concept code is publicly available. Refer to the linked vendor advisories for sanitized technical details.
Detection Methods for CVE-2026-0749
Indicators of Compromise
- Form Builder form definitions containing <script>, onerror=, onload=, or javascript: strings in label, description, or option fields
- Unexpected outbound requests from administrator browsers to unknown domains after viewing forms
- Database rows in Form Builder tables containing HTML entities or encoded JavaScript payloads
- Audit log entries showing form edits by accounts that do not normally manage forms
Detection Strategies
- Query the Drupal database for Form Builder fields matching script-injection patterns using regex against stored form metadata
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline script violations originating from form pages
- Enable web application firewall rules that flag stored payloads containing event handlers or script tags in form-submission endpoints
- Review Drupal watchdog logs for form creation and modification events tied to low-privilege accounts
Monitoring Recommendations
- Monitor authenticated sessions for unusual JavaScript execution patterns on administrative pages
- Alert on form edits performed outside normal administrative hours or by atypical user roles
- Track HTTP responses serving form pages for unexpected Content-Type mismatches or oversized payloads
- Correlate browser-side error reports with server-side form modification events
How to Mitigate CVE-2026-0749
Immediate Actions Required
- Restrict form creation and editing permissions to fully trusted administrative accounts only
- Audit all existing Form Builder forms for embedded HTML, scripts, or event handlers and remove malicious content
- Apply available vendor updates or extended-support patches as soon as they are released
- Enforce a strict Content Security Policy that disallows inline scripts on Drupal administrative pages
Patch Information
The vulnerability affects Drupal Form Builder 7.X-1.0 through 7.X-1.22. Drupal 7 reached end-of-life on January 5, 2025, and contributed modules such as Form Builder no longer receive official Drupal Security Team coverage. Organizations should consult the HeroDevs CVE-2026-0749 advisory for extended-support patches and the Tag1 Security Advisory for remediation guidance.
Workarounds
- Disable the Form Builder module if it is not essential to site operations
- Replace Form Builder with the actively maintained Webform module on Drupal 7 extended-support distributions
- Apply server-side input filters via hook_form_alter() to strip HTML from Form Builder field submissions
- Deploy a web application firewall rule blocking script tags and event-handler attributes in form-edit POST requests
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
