CVE-2026-10770: Drupal Anti-Spam CleanTalk XSS Vulnerability

CVE-2026-10770 Overview

CVE-2026-10770 is a reflected Cross-Site Scripting (XSS) vulnerability in the Drupal Anti-Spam by CleanTalk contributed module. The flaw stems from improper neutralization of input during web page generation [CWE-79]. Attackers can craft malicious URLs that, when clicked by an authenticated victim, execute arbitrary JavaScript in the victim's browser session. The vulnerability affects Anti-Spam by CleanTalk versions 0.0.0 through 9.7.1. Because the scope is changed, injected script can access resources beyond the vulnerable component's security context.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser, enabling session theft, credential harvesting, and unauthorized actions on behalf of authenticated Drupal users.

Affected Products

Drupal Anti-Spam by CleanTalk module versions 0.0.0 to 9.7.1
Drupal sites with the CleanTalk contributed module installed
All Drupal core versions where the vulnerable module is enabled

Discovery Timeline

2026-07-10 - CVE-2026-10770 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-10770

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the Drupal Anti-Spam by CleanTalk module. The module fails to properly sanitize user-supplied input before reflecting it back into HTML responses generated by the Drupal application. An attacker constructs a URL containing malicious JavaScript in a parameter that the module reflects into the rendered page without escaping. When a victim visits the crafted URL, the browser interprets the payload as executable script within the Drupal site's origin. User interaction is required, typically through a phishing link or malicious redirect. Because the scope changes, injected code can affect data or components outside the vulnerable module's security boundary.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The module accepts request parameters and embeds them into the HTML response without applying context-appropriate output encoding or Drupal's built-in sanitization APIs such as Html::escape() or t() with placeholders. Any characters that terminate HTML attribute values or open new tags are passed through unaltered, allowing script execution.

Attack Vector

Exploitation is performed over the network without authentication but requires user interaction. An attacker delivers a crafted URL to a targeted user through phishing, social media, or malicious advertising. When the victim clicks the link while authenticated to the affected Drupal site, the reflected payload executes with the victim's privileges. The attacker can then steal session cookies, perform actions in the victim's context, or pivot to administrative functions if the victim holds elevated permissions. See the Drupal Security Advisory for additional technical details.

Detection Methods for CVE-2026-10770

Indicators of Compromise

Web server access logs containing request parameters with HTML tags such as <script>, onerror=, or javascript: targeting CleanTalk module endpoints
Referer headers originating from untrusted external domains preceding suspicious module requests
Unusual JavaScript execution patterns in browser telemetry from users interacting with Drupal admin pages

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set that inspects query strings and form parameters for XSS payload signatures targeting Drupal module paths
Enable Drupal's watchdog logging and review requests to CleanTalk module routes for encoded payloads such as %3Cscript%3E or %22%3E%3C
Correlate outbound requests from user browsers to attacker-controlled domains that immediately follow visits to the vulnerable module URLs

Monitoring Recommendations

Monitor Content Security Policy (CSP) violation reports for script-src and inline-script violations originating from Drupal pages
Alert on authenticated session activity that includes cookie exfiltration patterns or anomalous administrative API calls following a reflected request
Track version inventory of the CleanTalk module across all Drupal deployments to identify hosts still running versions at or below 9.7.1

How to Mitigate CVE-2026-10770

Immediate Actions Required

Identify all Drupal instances running Anti-Spam by CleanTalk versions 0.0.0 through 9.7.1 and prioritize them for patching
Apply the fixed version released by the CleanTalk maintainers as documented in the Drupal Security Advisory
Invalidate active administrative sessions and rotate credentials for high-privilege users after patching

Patch Information

Update the Drupal Anti-Spam by CleanTalk module to a version later than 9.7.1. Follow the remediation guidance in the official Drupal Security Advisory sa-contrib-2026-042. After upgrading, clear Drupal caches with drush cr and verify the module version in the administrative interface.

Workarounds

Disable the Anti-Spam by CleanTalk module until the patched version can be installed if immediate upgrade is not possible
Deploy a WAF rule to block requests containing common XSS payloads directed at CleanTalk module endpoints
Enforce a strict Content Security Policy that disallows inline script execution to reduce the impact of reflected payloads

bash

# Example Drush commands to check module version and apply update
drush pm:list --type=module --status=enabled | grep cleantalk
drush pm:update cleantalk
drush cache:rebuild