CVE-2026-6871: Drupal Obfuscate Module Insufficient Input Sanitization Vulnerability
Summary
CVE-2026-6871: This module enables you to obfuscate email addresses in content. Affects drupal/obfuscate versions < 2.0.2. Fixed in 2.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Drupal Obfuscate module is designed to obfuscate email addresses in content to protect them from web scrapers and spam bots. It utilizes various encoding techniques, including ROT13, to mask email addresses. However, this module has a vulnerability that arises from insufficient sanitization of user input when processed through its Twig filter, potentially exposing sites to security risks.
Vulnerability Detail
The vulnerability stems from the module's failure to adequately sanitize user input, particularly when using the ROT13 encoding method. This oversight allows an attacker to inject malicious content that could be executed when the obfuscated email addresses are rendered. The impact of this vulnerability is significant as it can lead to unauthorized access or manipulation of site content, particularly on sites where users can submit content that is processed by the module's Twig filter.
How To Fix
Minimum fixed version
2.0.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the ROT13 encoding feature of the module if it is not essential for your site's functionality. This will prevent the exploitation of the vulnerability until you can apply the patch.
Conclusion
The Drupal Obfuscate module has a critical vulnerability due to insufficient input sanitization, particularly affecting sites using ROT13 encoding. It is essential to update to version 2.0.2 or higher to protect your site from potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for drupal/obfuscate →
FAQ
The vulnerability is due to insufficient sanitization of user input when processed through the module's Twig filter, specifically affecting sites using ROT13 encoding.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow attackers to inject malicious content, leading to unauthorized access or manipulation of site content.
Yes, a patch is available in version 2.0.2 of the Drupal Obfuscate module. It is recommended to update to this version to mitigate the risk.
If you cannot update the module right away, consider disabling the ROT13 encoding feature as a temporary workaround to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/obfuscate.
