A security flaw has been identified in the Drupal Form Builder module, known as a Cross-Site Scripting (XSS) vulnerability. This issue, tracked as CVE-2026-0749, means that if exploited, it could allow an attacker to inject malicious code into web pages. While serious, this particular vulnerability is considered “Medium” severity because exploiting it requires the attacker to have specific administrative permissions on the Drupal site.
CVE Details
This vulnerability affects the Drupal Form Builder module. It was publicly disclosed on January 28, 2026, and its status is currently Analyzed.
Affected Products
The Cross-Site Scripting (XSS) vulnerability impacts the following versions of the Drupal Form Builder module:
- Versions from 7.X-1.0 up to and including 7.X-1.22
- Versions up to and including 7.X-2.0-alpha8
Essentially, if you are running any of these older versions, your Drupal site could be at risk.
Current Status
The vulnerability, CVE-2026-0749, has been thoroughly analyzed by security experts. This means the nature of the flaw, its potential impact, and possible solutions are well understood.
Severity Level
This XSS vulnerability is rated as Medium Severity. The reason it’s not rated higher is due to the conditions required for an attack. An attacker would need to have specific administrative permissions that allow them to embed specially formatted HTML link tags containing harmful JSON data. This significantly limits the pool of potential attackers, making it a “less critical” XSS compared to those that can be exploited by any site visitor.
Possible Solutions
To protect your Drupal site from this XSS vulnerability, it is crucial to update your Form Builder module to a patched version. Developers have released updates that address this issue. Here are the recommended solutions:
- For users on the 7.x-1.x branch, upgrade to Form Builder module version 7.x-1.23 or later.
- For users on the 7.x-2.x-alpha branch, upgrade to Form Builder module version 7.x-2.0-alpha9 or later.
You can find the latest versions and download links from the official repositories:
- Form Builder Releases on GitLab
- Direct download for 7.x-1.23: form_builder-7.x-1.23.tar.gz
- Direct download for 7.x-1.23: form_builder-7.x-1.23.zip
- Direct download for 7.x-2.0-alpha9: form_builder-7.x-2.0-alpha9.gz
- Direct download for 7.x-2.0-alpha9: form_builder-7.x-2.0-alpha9.zip
It is always recommended to keep your software up to date to ensure you have the latest security patches.
References
https://d7es.tag1.com/security-advisories/form-builder-less-critical-cross-site-scripting
https://www.herodevs.com/vulnerability-directory/cve-2026-0749
