CVE-2026-96379 in CookieCuttr
Summary
by MITRE • 10/22/2026
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allows Stored XSS. This issue affects CookieCuttr versions: from 2.0.0 to 2.0.3.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The CVE identified relates to a critical security flaw within the Drupal module known as CookieCuttr, specifically affecting version ranges from 2.0.0 through 2.0.3. This vulnerability is classified under CWE-79, which denotes Improper Neutralization of Input During Web Page Generation, commonly referred to as Cross-site Scripting or XSS. The specific manifestation in this context is a Stored XSS vulnerability, meaning that malicious scripts are permanently stored on the target server within the application's database or other persistent storage mechanisms rather than being executed solely through immediate user interaction like query parameters. This distinction significantly elevates the severity of the issue because every user who views the affected page will have their session compromised without needing to click a specially crafted link, thereby amplifying the potential blast radius of an attack.
The technical root cause lies in how the CookieCuttr module handles input data related to cookie consent configurations or custom messages provided by site administrators or potentially manipulated content creators. In vulnerable versions, the application fails to adequately sanitize or encode user-supplied input before rendering it within HTML responses served to end-users. When a malicious actor injects JavaScript code into these fields, typically via administrative interfaces where such inputs are permitted for customization of cookie banners or consent dialogs, the Drupal system stores this payload as part of the site's configuration data. Subsequently, when any visitor loads a page containing the cookie banner, the browser executes the embedded script in the context of the victim’s session and domain. This allows attackers to bypass same-origin policies that normally restrict scripts from interacting with content on different domains, enabling them to access sensitive information such as authentication cookies, session tokens, or personally identifiable information stored within the user's local storage.
From an operational perspective, a successful exploitation of this Stored XSS vulnerability can lead to severe consequences including account takeover, defacement of the website, redirection of users to malicious phishing sites, and the installation of malware on client machines through drive-by downloads facilitated by the injected scripts. Because Drupal is widely used for content management across enterprise environments, educational institutions, and government bodies, the impact extends beyond individual site compromises to potential large-scale data breaches if multiple instances are targeted or if an attacker gains a foothold within a larger network infrastructure via compromised administrative credentials obtained through cookie theft. The persistence of the payload ensures that the attack remains active until the malicious content is manually removed from the database by a system administrator, making remediation dependent on both patching and cleanup efforts.
Industry frameworks such as MITRE ATT&CK categorize this type of vulnerability under techniques related to Client-side Scripting Injection, specifically aligning with T1059 which covers command and script interpreter execution via browser-based vectors. The attack lifecycle involves initial access through the administrative interface or content submission forms, followed by persistence due to the stored nature of the XSS payload, and finally credential access or privilege escalation once victim sessions are hijacked. Security professionals must recognize that Stored XSS is particularly dangerous in CMS environments because it leverages the trust users place in the website’s domain while exploiting the lack of output encoding on dynamic content generated from database queries.
To mitigate this vulnerability, organizations running Drupal instances with CookieCuttr versions between 2.0.0 and 2.0.3 must immediately upgrade to a patched version where input validation and output encoding have been rigorously implemented. Developers should ensure that all user inputs are strictly validated against expected formats using allowlists rather than blocklists, and that any data rendered in HTML contexts is properly encoded using functions like Drupal’s check_plain or similar context-aware escaping mechanisms. Additionally, implementing Content Security Policy headers can provide an additional layer of defense by restricting the sources from which scripts can be loaded, thereby mitigating the impact even if some injection attempts succeed. Regular security audits and penetration testing focused on input handling in administrative panels are recommended to detect and prevent such flaws before they can be exploited in production environments.