CVE-2026-114525: ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224
Published Oct 30, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS. This issue affects ABC versions: from 0.0.0 to 1.25.0, from 2.0.0 to 2.0.1.
Affected Software
1 affected component
Drupal ABC>=0.0.0<=1.25.0, >=2.0.0<=2.0.1
Event History
Oct 30, 2026
CVE Published
via MITRE·03:09 AM
Data Sourced
via MITRE·03:09 AM
DescriptionWeakness
Data Sourced
via OSV·03:09 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:18 AM
DescriptionWeakness
Nov 6, 2026
Data Sourced
via NVD·04:17 PM
Severity
Frequently Asked Questions
1
Which ABC versions are affected?
Affected versions are 0.0.0 through 1.25.0 and 2.0.0 through 2.0.1.
2
What kind of attacker access is required to exploit this issue?
The provided information identifies this as stored XSS but does not state the required attacker privileges, input path, or configuration conditions.
3
Is a default ABC installation affected?
The provided information does not specify whether the vulnerable behavior is enabled or reachable in the default configuration.
4
What mitigation is available if an update cannot be applied immediately?
No temporary mitigation or workaround is provided in the available information.