DRUPAL-CONTRIB-2026-294: XSS

Q: Which deployments should prioritize triage?

Drupal sites using composer/drupal/content_synchronizer should prioritize review, especially where content archives are imported between sites. The issue is in client-side handling of insufficiently sanitized input.

Q: What would an attacker need to control to exploit this issue?

The attacker would need to supply input that reaches the module's client-side code and is not sufficiently sanitized. The available data does not identify the exact archive contents, import workflow, or required permissions.

Published Nov 4, 2026

Updated

The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files.

The module doesn't sufficiently sanitize input passed to its client-side code, leading to a DOM-based cross-site scripting (XSS) vulnerability.

Affected Software

1 affected componentFixes available

composer/drupal/content_synchronizer<4.1.1

4.1.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/content_synchronizer to a version that resolves this vulnerability.
Fixed in 4.1.1

Event History

Nov 4, 2026

Advisory Published

via OSV·05:29 PM

Data Sourced

via OSV·05:29 PM

DescriptionAffected Software

Frequently Asked Questions

Which deployments should prioritize triage?

Drupal sites using composer/drupal/content_synchronizer should prioritize review, especially where content archives are imported between sites. The issue is in client-side handling of insufficiently sanitized input.

What would an attacker need to control to exploit this issue?

The attacker would need to supply input that reaches the module's client-side code and is not sufficiently sanitized. The available data does not identify the exact archive contents, import workflow, or required permissions.