CVE-2026-6095

中 6.1CVE-2026-6095 · DRUPAL-CONTRIB-2026-032 · 19/05/2026 公開 · 24/07/2026 更新

要点

CVE-2026-6095 は drupal/orejime, orejime (gaya) に影響する深刻度「中」 (CVSS 6.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.20%（全脆弱性の 9.3% より高い）。
対処：2.0.16 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
drupal/orejime Packagist:https://packages.drupal.org/8	`< 2.0.16`	`2.0.16`
orejime gaya	`< 2.0.16`	`2.0.16`

概要

The IframeConsent element writes HTML attributes without escaping their value.

This module has a XSS vulnerability. If an attacker is able to write an <iframe-consent> tag, they may be able to insert arbitrary JavaScript.

This vulnerability is mitigated by the fact that a text format that allows iframe-consent HTML tags with alt attributes in the necessary option (Enable JS Iframe consent) must be enabled, and an attacker must have a role allowing the creation or modification of content in a field with text the format.

NVD の説明

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime allows Cross-Site Scripting (XSS). This issue affects Orejime: from 0.0.0 before 2.0.16.