Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-25T23:16:56.787Z",
  "pubdate": "2026-08-25T23:16:56.787Z",
  "executiveSummary": "Search API Autocomplete contains a Reflected Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user-supplied input during web page generation.\nThis vulnerability allows an attacker to inject malicious scripts into the web application, which are subsequently executed in the context of the victim's browser session.\nThe flaw affects Search API Autocomplete versions 0.0.0 through 1.12.0.\nSuccessful exploitation can lead to unauthorized actions performed on behalf of the user, session hijacking, credential theft, or unauthorized redirection.\nThe vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').\nExploitation generally requires an attacker to convince a victim to interact with a maliciously crafted link, making the attack vector contingent on social engineering or existing traffic interception.",
  "technicalDetails": "The vulnerability exists within the Search API Autocomplete module, specifically within the logic responsible for rendering autocomplete suggestions based on user input.\nThe root cause is the failure to properly sanitize or encode input parameters before embedding them into the HTTP response. The module fails to sanitize the query parameters utilized in the search request, allowing for the injection of arbitrary HTML and JavaScript tags into the generated DOM.\nThe attack flow begins when an attacker crafts a malicious URL containing a JavaScript payload within the search query parameter used by the autocomplete functionality. When an unsuspecting authenticated user clicks on this crafted link, the victim's browser initiates a request to the server. The application then includes the unsanitized malicious input directly into the rendered response for the autocomplete suggestions.\nBecause the server returns the input without proper context-aware output encoding (such as escaping characters like <, >, and \"), the browser interprets the injected script as valid code belonging to the site's origin.\nThe execution occurs within the security context of the victim's session, granting the attacker the ability to access cookies, session tokens, and sensitive data stored in local or session storage, or perform unauthorized administrative actions if the victim holds elevated privileges.\nAffected versions are 0.0.0 through 1.12.0. The vulnerability is accessible over the network and does not inherently require prior authentication to the application, although the impact is significantly higher when the victim is an authenticated user with administrative or editor privileges.\nThe payload behavior is typical of Reflected XSS, where the script exists only within the immediate HTTP response and does not persist on the server. However, the potential for persistent impact remains high through session manipulation or by utilizing the XSS to perform subsequent modifications to the application state."
}