CVE-2026-6095: Drupal Orejime XSS Vulnerability

CVE-2026-6095 Overview

CVE-2026-6095 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Orejime contributed module. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers can inject malicious script content that executes in the browser of a victim user who interacts with a crafted link or page. The issue affects all Orejime releases from 0.0.0 before 2.0.16. Successful exploitation requires user interaction and can lead to session compromise, credential theft, or unauthorized actions performed in the victim's authenticated context within the Drupal site.

Critical Impact

Attackers can execute arbitrary JavaScript in victim browsers, enabling session theft and unauthorized actions across the affected Drupal site.

Affected Products

• Drupal Orejime module versions prior to 2.0.16
• Drupal sites using Orejime for cookie consent management
• All Orejime releases from 0.0.0 up to but not including 2.0.16

Discovery Timeline

• 2026-05-19 - CVE-2026-6095 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-6095

Vulnerability Analysis

The Orejime module provides cookie consent functionality for Drupal sites. The vulnerability is classified under [CWE-79], Improper Neutralization of Input During Web Page Generation. User-controllable input flows into rendered HTML output without sufficient sanitization or output encoding. An attacker can craft input containing JavaScript payloads that the module renders verbatim in the response. When a victim loads the affected page or follows a crafted link, the browser executes the injected script in the context of the vulnerable Drupal origin.

The CVSS vector indicates a network-based attack that requires user interaction and produces a scope change. The scope change reflects that injected scripts execute in the browser security context, affecting resources beyond the vulnerable component itself.

Root Cause

The root cause is missing or insufficient output encoding when the Orejime module renders configuration values or user-supplied strings into HTML. Drupal provides rendering APIs and Twig auto-escaping, but the affected code paths bypass or misuse these protections. The fix in version 2.0.16 introduces proper neutralization of special characters before output.

Attack Vector

Exploitation requires an attacker to deliver a crafted URL or stored payload to a victim. The attacker injects HTML or JavaScript content into a vulnerable parameter or stored configuration field. When the victim's browser renders the page, the payload executes. Because the scope changes, the script can access cookies, session tokens, and DOM content tied to the Drupal site origin. The vulnerability does not require authentication to trigger but does require victim interaction.

No public proof-of-concept exploit is available at the time of publication. Refer to the Drupal Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-6095

Indicators of Compromise

• Unexpected <script> tags, javascript: URIs, or event handler attributes (onerror, onload) in Drupal page responses generated by Orejime
• Web server access logs showing requests with encoded script payloads in query parameters or POST bodies targeting Orejime endpoints
• Outbound browser requests from authenticated user sessions to attacker-controlled domains following visits to Orejime-rendered pages

Detection Strategies

• Inventory all Drupal sites and identify those using the Orejime module with version below 2.0.16
• Inspect HTTP response bodies from Orejime-rendered components for unescaped angle brackets, quotes, or script content originating from user input
• Deploy Content Security Policy (CSP) reporting endpoints to capture violations indicating script injection attempts

Monitoring Recommendations

• Monitor Drupal watchdog logs and web server logs for anomalous payloads containing <script, onerror=, or javascript: patterns directed at Orejime routes
• Alert on session cookie access patterns inconsistent with normal user activity, which may indicate stolen tokens from XSS payloads
• Track module version drift across Drupal estates to detect sites still running vulnerable Orejime releases

How to Mitigate CVE-2026-6095

Immediate Actions Required

• Upgrade the Orejime module to version 2.0.16 or later on all Drupal sites
• Review site configuration entries managed by Orejime for any pre-existing injected payloads
• Invalidate active user sessions if compromise is suspected, then require re-authentication

Patch Information

The Drupal security team published advisory SA-CONTRIB-2026-032 covering this issue. The fix is available in Orejime 2.0.16. Apply the update through Composer or the Drupal admin interface and clear the site cache after upgrade. See the Drupal Security Advisory for complete patch details.

Workarounds

• Disable the Orejime module until the upgrade can be applied if patching is not immediately feasible
• Deploy a strict Content Security Policy that restricts inline scripts and limits permitted script sources
• Place a web application firewall rule in front of the Drupal site to filter requests containing common XSS payload patterns targeting Orejime endpoints

# Configuration example: upgrade Orejime via Composer and clear cache
composer update drupal/orejime --with-dependencies
drush updatedb
drush cache:rebuild