CVE-2026-16640

The Search API Autocomplete module in Drupal is vulnerable to reflected cross-site scripting (XSS) due to improper input neutralization during web page generation. This flaw could allow attackers to execute arbitrary scripts in the context of a user's session, potentially leading to data theft or session hijacking. Organizations using affected versions (0.0.0 to 1.12.0) of the Search API Autocomplete should prioritize patching this vulnerability to protect their users.