DRUPAL-CONTRIB-2026-224: ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224

Q: What does an attacker need to exploit this issue?

The attack can be initiated over the network and has low attack complexity. It does not require attacker privileges, but it does require user interaction.

Q: What is the expected security impact if exploitation succeeds?

The CVSS vector indicates low impact to confidentiality, integrity, and availability. The vulnerability also has a changed scope, meaning the impact can extend beyond the initially vulnerable security authority.

Published Oct 30, 2026

Updated

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS. This issue affects ABC versions: from 0.0.0 to 1.25.0, from 2.0.0 to 2.0.1.

Affected Software

1 affected component

Drupal ABC>=0.0.0<=1.25.0, >=2.0.0<=2.0.1

Event History

Oct 30, 2026

CVE Published

via OSV·03:09 AM

Data Sourced

via OSV·03:09 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attack can be initiated over the network and has low attack complexity. It does not require attacker privileges, but it does require user interaction.

What is the expected security impact if exploitation succeeds?