SA-CONTRIB-2026-103: XSS
The Address Suggestion module provides address autocomplete functionality using configured address providers. The module doesn't sufficiently sanitize address suggestion data returned by configured providers, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must be able to inject malicious content into data returned by a configured address provider, and a user must perform a search that returns the malicious suggestion.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/address_suggestionto a version that resolves this vulnerability.Fixed in 1.0.25
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
An attacker must be able to inject malicious content into the address suggestion data returned by a configured address provider. A user must then perform a search that returns the malicious suggestion.
Who is exposed to the XSS risk?
Users who use address autocomplete and receive a malicious suggestion from a configured provider may be exposed. The issue depends on both attacker control of provider-returned data and the user triggering a search that includes that data.