CVE-2026-118566: XSS

Q: What must an attacker be able to do to exploit this issue?

The attacker needs to supply input that reaches the module's client-side code, such as through the archive-based content export or import workflow. The available information does not specify whether authentication or particular permissions are required.

Q: What is the impact of successful exploitation?

Successful exploitation results in DOM-based cross-site scripting in the affected Drupal site's users' browsers. The provided information does not state which user roles or pages can be targeted.

Published Nov 4, 2026

Updated

The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files.

The module doesn't sufficiently sanitize input passed to its client-side code, leading to a DOM-based cross-site scripting (XSS) vulnerability.

Affected Software

1 affected componentFixes available

composer/drupal/content_synchronizer<4.1.1

4.1.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/content_synchronizer to a version that resolves this vulnerability.
Fixed in 4.1.1

Event History

Nov 4, 2026

Advisory Published

via OSV·05:29 PM

Data Sourced

via OSV·05:29 PM

DescriptionAffected Software

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

The attacker needs to supply input that reaches the module's client-side code, such as through the archive-based content export or import workflow. The available information does not specify whether authentication or particular permissions are required.

What is the impact of successful exploitation?

Successful exploitation results in DOM-based cross-site scripting in the affected Drupal site's users' browsers. The provided information does not state which user roles or pages can be targeted.