CVE-2026-3213: XSS in Drupal Anti-Spam by CleanTalk

Successful exploitation of CVE-2026-3213 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser. This can manifest in several ways, including stealing session cookies to impersonate users, redirecting users to malicious websites, or defacing the website. The impact is particularly severe for sites with sensitive user data or those handling financial transactions. Given the module's purpose – spam filtering – attackers might attempt to inject scripts that bypass spam filters, further compromising the site's security. The blast radius extends to all users interacting with pages affected by the XSS vulnerability.

1. Reserved2026-02-25
2. Published2026-03-25
3. Modified2026-03-31
4. EPSS updated2026-04-02

The primary mitigation for CVE-2026-3213 is to immediately upgrade the Drupal Anti-Spam by CleanTalk module to version 9.7.0 or later. If upgrading is not immediately feasible due to compatibility concerns or testing requirements, consider implementing input validation and output encoding on user-supplied data within the module. While not a complete solution, a Web Application Firewall (WAF) configured to detect and block XSS payloads can provide an additional layer of defense. Review Drupal's security best practices for XSS prevention, including enabling HTML filtering and using a Content Security Policy (CSP). After upgrading, verify the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) into a form field and confirming that the script is not executed.