CVE-2026-16640: Drupal Search API Autocomplete XSS Flaw

CVE-2026-16640 Overview

CVE-2026-16640 is a reflected cross-site scripting (XSS) vulnerability in the Drupal Search API Autocomplete contributed module. The module improperly neutralizes user-supplied input during web page generation, allowing attackers to inject malicious script content that executes in a victim's browser. The flaw affects Search API Autocomplete versions from 0.0.0 up to and including 1.12.0. The weakness is categorized under [CWE-79]. Exploitation requires user interaction, such as clicking a crafted link, but no authentication is needed.

Critical Impact
A successful attack executes arbitrary JavaScript in the victim's browser session, enabling session theft, credential harvesting, and unauthorized actions against the Drupal site under the victim's privileges.

Affected Products

Drupal Search API Autocomplete module versions 0.0.0 through 1.12.0
Drupal sites using Search API Autocomplete for search suggestions
Any Drupal deployment where the vulnerable module is enabled and reachable by unauthenticated users

Discovery Timeline

2026-08-25 - CVE-2026-16640 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-16640

Vulnerability Analysis

The Search API Autocomplete module returns user-controllable input in HTTP responses without sufficient output encoding. When a crafted request reaches an autocomplete endpoint, the reflected value is rendered in the page context, and any embedded script executes with the origin of the Drupal site.

The scope-changed nature of the flaw means injected script can affect resources beyond the vulnerable component's initial security boundary. Attackers typically deliver the payload through phishing links, malicious referrers, or third-party sites that submit crafted requests to the target Drupal instance.

Because the module is commonly exposed to anonymous users to power search suggestions, the attack surface is broad. Successful exploitation can lead to theft of session cookies, cross-site request forgery pivots against authenticated users, and defacement of rendered content.

Root Cause

The root cause is improper neutralization of input during web page generation, classified as [CWE-79]. Input received by the autocomplete handler is echoed into the response without contextual escaping or sanitization sufficient to prevent HTML and JavaScript injection.

Attack Vector

The vulnerability is exploitable over the network with low attack complexity. The attacker crafts a URL or request containing a malicious payload targeting the vulnerable autocomplete endpoint. The victim must interact with the crafted link, after which the reflected payload executes in the browser. No verified public exploit or proof-of-concept is currently listed for CVE-2026-16640. Refer to the Drupal Security Advisory 2026-082 for vendor-provided technical details.

Detection Methods for CVE-2026-16640

Indicators of Compromise

Web server access logs containing autocomplete requests with unusual characters such as <, >, ", ', or URL-encoded equivalents (%3C, %3E, %22)
Requests to Search API Autocomplete endpoints containing <script>, onerror=, onload=, or javascript: tokens
Referer headers pointing to attacker-controlled domains directing users to autocomplete URLs on the Drupal host

Detection Strategies

Deploy web application firewall (WAF) signatures that flag reflected XSS payloads targeting /search_api_autocomplete/* and related Drupal paths
Correlate anomalous query strings on autocomplete endpoints with follow-on authenticated session activity from the same client
Review Drupal watchdog logs for repeated malformed autocomplete queries originating from a small set of IPs or user agents

Monitoring Recommendations

Enable and centralize HTTP access, referer, and user-agent logging for all Drupal frontends
Monitor Content Security Policy (CSP) violation reports for inline script or unexpected script source violations
Track outbound requests from browsers to unknown domains following visits to Drupal search pages, which may indicate exfiltration via injected script

How to Mitigate CVE-2026-16640

Immediate Actions Required

Upgrade the Search API Autocomplete module to a fixed release above 1.12.0 as identified in Drupal Security Advisory 2026-082
Audit Drupal sites for the presence and version of the Search API Autocomplete module using drush pm:list or the module administration page
Rotate administrator session cookies and review recent administrative actions if suspicious autocomplete traffic is present in logs

Patch Information

Apply the fixed version of the Search API Autocomplete module as directed by the vendor advisory. Consult the Drupal Security Advisory 2026-082 for the specific fixed release, patch commits, and upgrade instructions. After patching, clear Drupal caches with drush cr to ensure updated module code is loaded.

Workarounds

Disable the Search API Autocomplete module until the patched version can be deployed
Restrict access to autocomplete endpoints to authenticated users via reverse proxy or Drupal access rules where feasible
Enforce a strict Content Security Policy that disallows inline scripts and limits script sources to trusted origins to reduce the impact of reflected payloads

bash

# Example: disable the module and clear caches using Drush
drush pm:uninstall search_api_autocomplete
drush cr

# After upgrading to the fixed release
drush pm:update search_api_autocomplete
drush updatedb
drush cr