SA-CONTRIB-2026-219: XSS
Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administrators. The module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes or the administer menu permission.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/ginto a version that resolves this vulnerability.Fixed in 4.1.4Fixed in 5.0.16
Event History
Frequently Asked Questions
Who is realistically able to exploit this issue?
An attacker must either have a role permitted to enter HTML tags containing the relevant specific data attributes, or have the administer menu permission. Users without either capability are not described as able to exploit it.
Does this affect a default low-privilege user configuration?
The vulnerability is mitigated by the required permissions. It is not described as exploitable by users who cannot enter HTML tags with the relevant data attributes and do not have administer menu permission.
What can be done if a fix cannot be applied immediately?
Restrict the ability to enter HTML tags containing the relevant data attributes and limit the administer menu permission to trusted users. Review roles that currently grant either capability.