SA-CONTRIB-2026-304: XSS

Q: Which deployments should be assessed?

Deployments using the composer/drupal/name package should be assessed, particularly where Name Field values are stored and later displayed to users.

Q: What is required for exploitation?

An attacker would need to cause a crafted value to be stored in a Name Field under affected circumstances. Exploitation occurs when that stored value is interpreted as HTML, allowing cross-site scripting in a viewer's browser.

Published Nov 4, 2026

Updated

The Name Field module provides a field for storing a personal name as separate components. The module does not sufficiently sanitize values under some circumstances. A name stored on the field can be interpreted as HTML, which can lead to a cross-site scripting (XSS) vulnerability.

Credit

Conrad Lara (cmlara)

Affected Software

1 affected componentFixes available

composer/drupal/name<8.x-1.6

8.x-1.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/name to a version that resolves this vulnerability.
Fixed in 8.x-1.6

Event History

Nov 4, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-122073

Frequently Asked Questions

Which deployments should be assessed?

Deployments using the composer/drupal/name package should be assessed, particularly where Name Field values are stored and later displayed to users.

What is required for exploitation?

An attacker would need to cause a crafted value to be stored in a Name Field under affected circumstances. Exploitation occurs when that stored value is interpreted as HTML, allowing cross-site scripting in a viewer's browser.

SA-CONTRIB-2026-304: XSS

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should be assessed?

What is required for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be assessed?

What is required for exploitation?