SA-CONTRIB-2026-232: Critical severity drupal/block_attributes vulnerability
Published Oct 21, 2026
·Updated
This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently sanitize attributes against cross site scripting. This issue is mitigated by the fact that the attacker must have the administer blocks permission.
Credit
Marcus Johansson (marcus_johansson)
Affected Software
1 affected componentFixes available
drupal/block_attributes<2.1.0
2.1.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/block_attributesto a version that resolves this vulnerability.Fixed in 2.1.0
Event History
Oct 21, 2026
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software