CVE-2026-114526: Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS. This issue affects Black Hole versions: from 0.0.0 to 1.26.0, from 2.0.0 to 2.0.1.
Affected Software
Event History
Frequently Asked Questions
Which Black Hole installations are affected?
Affected versions are 0.0.0 through 1.26.0 and 2.0.0 through 2.0.1. The provided information does not identify an unaffected fixed version.
What type of attacker access is required?
The issue is a stored cross-site scripting vulnerability caused by improper neutralization of input during web page generation. The provided information does not specify which user role, permission, or input field an attacker must be able to use.
How can I determine whether my site is exposed?
Check whether the Drupal Black Hole module is installed and identify its version. Instances running a version within either affected range should be treated as vulnerable.