{"id":"DRUPAL-CONTRIB-2020-013","details":"The Webform module allows site builders to create forms.\n\nThe module doesn't sufficiently prevent malicious code from being render via an options elements (i.e select menu, checkboxes, radios, etc...) under the scenario where the site builder allows the raw option value to be displayed.\n\nThis vulnerability is mitigated by the fact that site builder must be allowed to build webform and select raw as the options element's submission display.","modified":"2026-09-10T03:46:04.531801834Z","published":"2020-05-06T16:50:39Z","references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2020-013"}],"affected":[{"package":{"name":"drupal/webform","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/webform?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.0"}],"database_specific":{"constraint":"\u003c5.11.0"}}],"database_specific":{"affected_versions":"\u003c5.11.0","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/webform/DRUPAL-CONTRIB-2020-013.json"}}],"schema_version":"1.9.0","credits":[{"name":"Dan Chadwick","contact":["https://www.drupal.org/user/504278"]}]}