DRUPAL-CONTRIB-2026-335: XSS

Q: What capabilities would an attacker need to exploit this issue?

An attacker must be able to control an Ajax response, or be able to add markup containing specific attributes to a page.

Q: Which deployments are most exposed?

Deployments where untrusted users or integrated systems can influence Ajax responses or add page markup with the required attributes are exposed. The issue is mitigated when attackers cannot obtain either capability.

Q: What component should be reviewed during triage?

Review uses of the module's custom Ajax command that opens the iframe dialog, especially any path where its dialog options can be influenced by Ajax data or page markup.

Published Nov 11, 2026

Updated

This module renders Layout Builder forms inside an iframe in a modal dialog, using the admin theme.

The module provides its own Ajax command to open the iframe dialog. This command does not sanitize the dialog options the same way Drupal core does since SA-CORE-2026-001, which can lead to a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must be able to control the Ajax response, or be able to add markup with specific attributes to a page.

Affected Software

1 affected componentFixes available

composer/drupal/layout_builder_iframe_modal<1.3.9

1.3.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/layout_builder_iframe_modal to a version that resolves this vulnerability.
Fixed in 1.3.9

Event History

Nov 11, 2026

Advisory Published

via OSV·06:04 PM

Data Sourced

via OSV·06:04 PM

DescriptionAffected Software

Frequently Asked Questions

What capabilities would an attacker need to exploit this issue?

An attacker must be able to control an Ajax response, or be able to add markup containing specific attributes to a page.

Which deployments are most exposed?

Deployments where untrusted users or integrated systems can influence Ajax responses or add page markup with the required attributes are exposed. The issue is mitigated when attackers cannot obtain either capability.

What component should be reviewed during triage?

Review uses of the module's custom Ajax command that opens the iframe dialog, especially any path where its dialog options can be influenced by Ajax data or page markup.

DRUPAL-CONTRIB-2026-335: XSS

Affected Software

Remediation

Event History

Frequently Asked Questions

What capabilities would an attacker need to exploit this issue?

Which deployments are most exposed?

What component should be reviewed during triage?

Company

Resources

Contact

Frequently Asked Questions

What capabilities would an attacker need to exploit this issue?

Which deployments are most exposed?

What component should be reviewed during triage?