{"self":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-6095","first":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-6095\u0026page=0","last":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-6095\u0026page=0","list":[{"field_issue_status":"7","field_project":{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3114874","id":"3114874","resource":"node"},"field_sa_advisory_id":"032","field_sa_coordinated_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/poker10\u0022 rel=\u0022nofollow\u0022\u003EJuraj Nemec (poker10)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/prudloff\u0022 rel=\u0022nofollow\u0022\u003EPierre Rudloff (prudloff)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/xjm\u0022 rel=\u0022nofollow\u0022\u003EJess  (xjm)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_criticality":"AC:Basic\/A:User\/CI:Some\/II:Some\/E:Theoretical\/TD:Default","field_sa_description":{"value":"\u003Cp\u003EThe IframeConsent element writes HTML attributes without escaping their value.\u003C\/p\u003E\n\u003Cp\u003EThis module has a XSS vulnerability. If an attacker is able to write an \u003Ccode class=\u0022language-php\u0022\u003E\u0026lt;iframe-consent\u0026gt;\u003C\/code\u003E tag, they may be able to insert arbitrary JavaScript.\u003C\/p\u003E\n\u003Cp\u003EThis vulnerability is mitigated by the fact that a text format that allows \u003Ccode class=\u0022language-php\u0022\u003Eiframe-consent\u003C\/code\u003E HTML tags with alt attributes in the necessary option (\u003Cem\u003EEnable JS Iframe consent\u003C\/em\u003E) must be enabled, and an attacker must have a role allowing the creation or modification of content in a field with text the format.\u003C\/p\u003E","format":"1"},"field_sa_fixed_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/fabsgugu\u0022 rel=\u0022nofollow\u0022\u003EFabien Gutknecht (fabsgugu)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/prudloff\u0022 rel=\u0022nofollow\u0022\u003EPierre Rudloff (prudloff)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_reported_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/prudloff\u0022 rel=\u0022nofollow\u0022\u003EPierre Rudloff (prudloff)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_solution":{"value":"\u003Cp\u003EInstall the latest version:\u003C\/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIf you use the 2.x branch of Orejime, upgrade to \u003Ca href=\u0022\/project\/orejime\/releases\/2.0.16\u0022 rel=\u0022nofollow\u0022\u003EOrejime 2.0.16\u003C\/a\u003E.\u003C\/li\u003E\n\u003C\/ul\u003E","format":"1"},"field_sa_type":"Cross-site scripting","field_issue_last_status_change":"1775839866","field_sa_cve":["CVE-2026-6095"],"field_is_psa":"0","field_affected_versions":"\u003C2.0.16","field_fixed_in":[{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3583624","id":"3583624","resource":"node"}],"nid":"3583703","vid":"14321910","is_new":false,"type":"sa","title":"Orejime - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-032","language":"en","url":"https:\/\/www.drupal.org\/sa-contrib-2026-032","edit_url":"https:\/\/www.drupal.org\/node\/3583703\/edit","status":"1","promote":"0","sticky":"0","created":"1775664594","changed":"1775839866","author":{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/406161","id":"406161","resource":"user","name":"Drupal Security Team"},"comment":"0","comments":[{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16542734","id":16542734,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16542735","id":16542735,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16542736","id":16542736,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16542784","id":16542784,"resource":"comment"}],"comment_count":0,"comment_count_new":false,"body":[],"feeds_item_guid":null,"feeds_item_url":null,"feed_nid":null,"flag_flag_tracker_follow_user":[],"flag_tracker_follower_count":null,"has_new_content":null,"last_comment_timestamp":"1775664594"}]}