SA-CONTRIB-2026-229: XSS
Published Oct 21, 2026
·Updated
Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box. A module specific to this distribution doesn't sufficiently sanitize media names, potentially leading to an XSS exploit. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create or edit a media entity.
Credit
Drew Webber (mcdruid)(the Drupal Security Team)
Affected Software
1 affected componentFixes available
drupal/sector<10.3.3, <10.4.2
10.3.310.4.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/sectorto a version that resolves this vulnerability.Fixed in 10.3.3Fixed in 10.4.2
Event History
Oct 21, 2026
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software