DRUPAL-CONTRIB-2026-219: Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219

Q: Which Gin Admin Theme releases are affected?

Affected releases are 0.0.0 through 4.1.4 and 5.0.0 through 5.0.16. The provided information does not identify fixed versions.

Q: What access and interaction are required for exploitation?

The CVSS vector indicates network reachability, low attack complexity, and low privileges required. It also indicates user interaction is required, meaning a user must interact with attacker-controlled content for the XSS to execute.

Q: What could a successful exploit impact?

The supplied severity vector rates confidentiality, integrity, and availability impacts as low. It also indicates scope is changed, so the vulnerable component's impact may extend beyond its own authorization boundary.

Published Oct 30, 2026

Updated

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting (XSS). This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 to 5.0.16.

Affected Software

1 affected component

Drupal Gin Admin Theme>=0.0.0<=4.1.4, >=5.0.0<=5.0.16

Event History

Oct 30, 2026

CVE Published

via OSV·03:09 AM

Data Sourced

via OSV·03:09 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Gin Admin Theme releases are affected?

Affected releases are 0.0.0 through 4.1.4 and 5.0.0 through 5.0.16. The provided information does not identify fixed versions.

What access and interaction are required for exploitation?

The CVSS vector indicates network reachability, low attack complexity, and low privileges required. It also indicates user interaction is required, meaning a user must interact with attacker-controlled content for the XSS to execute.

What could a successful exploit impact?