CVE-2026-126744: XSS
This module renders Layout Builder forms inside an iframe in a modal dialog, using the admin theme.
The module provides its own Ajax command to open the iframe dialog. This command does not sanitize the dialog options the same way Drupal core does since SA-CORE-2026-001, which can lead to a cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must be able to control the Ajax response, or be able to add markup with specific attributes to a page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/layout_builder_iframe_modalto a version that resolves this vulnerability.Fixed in 1.3.9
Event History
Frequently Asked Questions
What capabilities would an attacker need to exploit this issue?
An attacker must be able to control an Ajax response or add markup with specific attributes to a page. The issue is therefore mitigated where untrusted users cannot perform either action.
Which part of the module is involved?
The affected behavior is the module's custom Ajax command that opens Layout Builder iframe dialogs in modal windows. Its handling of dialog options does not apply the sanitization introduced in Drupal core by SA-CORE-2026-001.