CVE-2026-10770: Drupal CleanTalk Module Insufficient API Response Sanitization Vulnerability
Summary
CVE-2026-10770: This module provides spam protection using the CleanTalk cloud service. Affects drupal/cleantalk versions < 9.7.1. Fixed in 9.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The CleanTalk module for Drupal provides spam protection by utilizing the CleanTalk cloud service. It is designed to enhance website security by filtering out spam and malicious content. However, the module has a critical vulnerability that arises from its handling of API responses, which can lead to security risks if not addressed.
Vulnerability Detail
This vulnerability stems from the CleanTalk module's failure to properly sanitize API response messages before rendering them in HTML output. Specifically, the functions _cleantalk_die() and ct_die() directly output the CleanTalk API response without adequate sanitization. This oversight allows an attacker to inject arbitrary HTML or JavaScript into the output, potentially leading to cross-site scripting (XSS) attacks. The risk is heightened if an attacker can manipulate the CleanTalk cloud API response, such as through a man-in-the-middle attack or by compromising the API server.
How To Fix
Minimum fixed version
9.7.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the CleanTalk module until the update is applied. This will prevent any potential exploitation of the vulnerability while you prepare to update the module.
Conclusion
The CleanTalk module for Drupal has a critical vulnerability (CVE-2026-10770) due to insufficient sanitization of API responses. It is crucial to update to version 9.7.1 or later to mitigate the risk of exploitation. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for drupal/cleantalk →
FAQ
CVE-2026-10770 is a vulnerability in the Drupal CleanTalk module that allows for insufficient sanitization of API response messages, potentially leading to XSS attacks.
If you are using an affected version of the CleanTalk module (prior to 9.7.1), your site may be vulnerable. You can check your version in the Drupal admin interface or by using the Vulert playground.
If you cannot update the module right away, consider disabling the CleanTalk module as a temporary measure to mitigate the risk of exploitation.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check your application for vulnerabilities using the Vulert playground.
If exploited, this vulnerability could allow attackers to execute malicious scripts in the context of your website, potentially compromising user data and site integrity.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/cleantalk.
