SA-CONTRIB-2026-116: Critical severity drupal/monster_menus vulnerability
This module enables you to create one or more multisites with highly granular page permissions. The module doesn't sufficiently sanitize HTML code contained in the page name when displayed in the built-in tree browser. This results in a cross-site scripting vulnerability that may allow attackers to execute arbitrary JavaScript in the context of the user’s session. This vulnerability is mitigated by the fact that an attacker must have the ability to create pages whose page title supports HTML.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/monster_menusto a version that resolves this vulnerability.Fixed in 9.5.3
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be able to create pages whose page title supports HTML. The vulnerable content is a page name containing HTML.
Which users are exposed to the injected JavaScript?
Users who view the affected page name in the module's built-in tree browser may have arbitrary JavaScript executed in the context of their session.
How can exposure be reduced if a fix cannot be applied immediately?
Restrict the ability to create pages whose titles support HTML, and avoid displaying untrusted page names in the built-in tree browser.