DRUPAL-CORE-2026-015: Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
Affected Software
Event History
Frequently Asked Questions
Which Drupal core installations fall within the affected version ranges?
Affected ranges are 8.9.0 through 10.6.19, 11.0.0 through 11.3.19, 11.4.0 through 11.4.10, and 12.0.0-alpha1 through 12.0.0-beta2. Installations outside those stated ranges are not identified as affected by the provided data.
What access and interaction does exploitation require?
The severity vector indicates an attacker needs low-level privileges and that user interaction is required. The attack can be conducted over the network and has low attack complexity.
What could a successful exploit affect?
The provided severity vector rates confidentiality, integrity, and availability impact as low. It also indicates scope can change, meaning effects may extend beyond the initially vulnerable security authority.