CVE-2026-3212

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3212", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-02-25T16:59:27.087Z", "datePublished": "2026-03-25T15:22:11.601Z", "dateUpdated": "2026-03-26T14:38:54.095Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-03-25T15:22:11.601Z"}, "title": "Tagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013", "datePublic": "2026-02-25T18:45:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"vendor": "Drupal", "product": "Tagify", "collectionURL": "https://www.drupal.org/project/tagify", "repo": "https://git.drupalcode.org/project/tagify", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.2.49", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.49.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).<p>This issue affects Tagify: from 0.0.0 before 1.2.49.</p>"}]}], "references": [{"url": "https://www.drupal.org/sa-contrib-2026-013"}], "credits": [{"lang": "en", "value": "David L\u00c3\u00b3pez (akalam)", "type": "finder"}, {"lang": "en", "value": "Mingsong (mingsong)", "type": "finder"}, {"lang": "en", "value": "David L\u00c3\u00b3pez (akalam)", "type": "remediation developer"}, {"lang": "en", "value": "David Galeano (gxleano)", "type": "remediation developer"}, {"lang": "en", "value": "Mingsong (mingsong)", "type": "remediation developer"}, {"lang": "en", "value": "Damien McKenna (damienmckenna)", "type": "coordinator"}, {"lang": "en", "value": "Dan Smith (galooph)", "type": "coordinator"}, {"lang": "en", "value": "Greg Knaddison (greggles)", "type": "coordinator"}, {"lang": "en", "value": "Drew Webber (mcdruid)", "type": "coordinator"}, {"lang": "en", "value": "Jess (xjm)", "type": "coordinator"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T20:01:00.711708Z", "id": "CVE-2026-3212", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T14:38:54.095Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-3212", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T20:01:00.711708Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T20:01:11.224Z"}}], "cna": {"title": "Tagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "David L\u00c3\u00b3pez (akalam)"}, {"lang": "en", "type": "finder", "value": "Mingsong (mingsong)"}, {"lang": "en", "type": "remediation developer", "value": "David L\u00c3\u00b3pez (akalam)"}, {"lang": "en", "type": "remediation developer", "value": "David Galeano (gxleano)"}, {"lang": "en", "type": "remediation developer", "value": "Mingsong (mingsong)"}, {"lang": "en", "type": "coordinator", "value": "Damien McKenna (damienmckenna)"}, {"lang": "en", "type": "coordinator", "value": "Dan Smith (galooph)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Drew Webber (mcdruid)"}, {"lang": "en", "type": "coordinator", "value": "Jess (xjm)"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/tagify", "vendor": "Drupal", "product": "Tagify", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.2.49", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/tagify", "defaultStatus": "unaffected"}], "datePublic": "2026-02-25T18:45:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-013"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.49.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).<p>This issue affects Tagify: from 0.0.0 before 1.2.49.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-03-25T15:22:11.601Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3212", "state": "PUBLISHED", "dateUpdated": "2026-03-26T14:38:54.095Z", "dateReserved": "2026-02-25T16:59:27.087Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2026-03-25T15:22:11.601Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://www.drupal.org/project/tagify", "defaultStatus": "unaffected", "product": "Tagify", "repo": "https://git.drupalcode.org/project/tagify", "vendor": "Drupal", "versions": [{"lessThan": "1.2.49", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "source": "mlhess@drupal.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:factorial:tagify:*:*:*:*:*:drupal:*:*", "matchCriteriaId": "C90572B4-C9F3-49BD-B3C7-2420098CAF3D", "versionEndExcluding": "1.2.49", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.49."}, {"lang": "es", "value": "Neutralizaci\u00f3n Incorrecta de la Entrada Durante la Generaci\u00f3n de P\u00e1ginas Web ('cross-site scripting') vulnerabilidad en Drupal Tagify permite cross-site scripting (XSS). Este problema afecta a Tagify: desde 0.0.0 anterior a 1.2.49."}], "id": "CVE-2026-3212", "lastModified": "2026-06-17T10:43:13.243", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3212", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-25T20:01:00.711708Z", "version": "2.0.3"}}]}, "published": "2026-03-25T16:16:22.217", "references": [{"source": "mlhess@drupal.org", "tags": ["Vendor Advisory"], "url": "https://www.drupal.org/sa-contrib-2026-013"}], "sourceIdentifier": "mlhess@drupal.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "mlhess@drupal.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,1.2.49)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Tagify", "source": "cna", "vendor": "Drupal"}, "product": "tagify", "vendor": "drupal"}], "analysis": {"en": {"generated_at": "2026-03-27T20:50:37.971805+00:00", "value": {"mitigation_remediation": ["Upgrade the Tagify module to version 1.2.49 or newer on all Drupal sites.", "Verify on each site that the installed Tagify version is not less than 1.2.49.", "If an upgrade cannot be applied immediately, restrict the use of Tagify in untrusted content or temporarily disable the module until the patch is installed."], "summary": {"action": "Apply Patch", "impact": "Cross\u2011site scripting allowing arbitrary client\u2011side script execution"}, "threat_synthesis": {"affected_systems": "The issue affects the Tagify module for Drupal from the initial version 0.0.0 up to and including 1.2.48. All installations of Tagify before version 1.2.49 are vulnerable, so administrators should verify the module version on every site and determine whether a dangerous release is present.", "description_and_impact": "Drupal Tagify contains a cross\u2011site scripting flaw that occurs when user supplied content is rendered without proper escaping. The vulnerability allows an attacker to inject malicious JavaScript that runs in the browser of any visitor who views the affected content and can result in session hijacking, credential theft, defacement or delivery of additional payloads. This is a classic example of CWE\u201179.", "risk_and_exploitability": "The CVSS score of 5.4 indicates a moderate severity, while an EPSS score of less than 1 % suggests that attacks are currently considered unlikely. The vulnerability is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog. Exploitation requires an attacker to deliver crafted input that is rendered in the browser, thus the threat is client\u2011side and depends on users visiting the compromised content. Prevention hinges on upgrading the module or applying input filtering to eliminate the unsafe rendering."}}}}, "created": "2026-03-25T21:48:04.033625+00:00", "updated": "2026-03-29T20:28:26.415760+00:00", "vendors": ["drupal", "drupal$PRODUCT$tagify"]}