DRUPAL-CONTRIB-2026-223: Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223
Published Oct 30, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS. This issue affects Black Hole versions: from 0.0.0 to 1.26.0, from 2.0.0 to 2.0.1.
Affected Software
1 affected component
Drupal Black Hole>=0.0.0<=1.26.0, >=2.0.0<=2.0.1
Event History
Oct 30, 2026
CVE Published
via OSV·03:09 AM
Data Sourced
via OSV·03:09 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which versions are affected?
Affected versions are 0.0.0 through 1.26.0 and 2.0.0 through 2.0.1. The provided data does not identify a fixed version.
2
What level of access does an attacker need?
The vulnerability is remotely exploitable with low attack complexity and requires no privileges. Exploitation requires user interaction.
3
What is the potential impact of successful exploitation?
Successful stored XSS can affect confidentiality, integrity, and availability at low impact levels. The vulnerability has a changed scope, meaning its effects may extend beyond the vulnerable component's security authority.