SA-CONTRIB-2026-140: XSS
This module enables you to manage content deletion and provides reports for identifying orphaned content. The module doesn't sufficiently sanitize node titles when displaying the orphaned nodes report. This leads to a persistent cross-site scripting vulnerability (XSS). This vulnerability is mitigated by the fact that an attacker must have permission to create content of a content type configured for the orphaned nodes report.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/safedeleteto a version that resolves this vulnerability.Fixed in 1.0.88
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Exposure is limited to sites where the orphaned nodes report is configured for at least one content type that an attacker can create. The issue occurs when titles are displayed in that report.
What level of access does an attacker need?
An attacker needs permission to create content for a content type configured for the orphaned nodes report. No other prerequisite is stated.
What can be done while a fix is unavailable?
Restrict content-creation permission for any content types configured in the orphaned nodes report, particularly for untrusted users. Review the report configuration and associated content-type permissions to identify the affected exposure path.