Backdrop CMS Mail Disguise Module Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in the Mail Disguise module for Backdrop CMS, affecting all versions prior to 1.x-1.0.5. The module is designed to obfuscate email addresses to prevent spambots from collecting them. However, it fails to properly validate the data attribute values on links, which could be exploited to inject malicious scripts. This vulnerability requires an attacker to insert link HTML elements with data attributes into the page.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users are advised to upgrade to the latest version of the Mail Disguise module. The updated version can be downloaded from the Mail Disguise module page on the Backdrop CMS website.