SA-CONTRIB-2026-311: XSS
This module integrates the Site Catalyst or AdobeAnalytics software into a Drupal site. The module does not sufficiently provide access controls for advanced functionality, which exposes a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have permission to add or edit content that is configured to use the module's functionality.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/adobe_analyticsto a version that resolves this vulnerability.Fixed in 8.x-1.1
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Sites are exposed where content can be added or edited by users who have permission to use the module's functionality. The issue is mitigated when untrusted users do not have those permissions.
What access does an attacker need?
An attacker must be able to add or edit content that is configured to use the module's functionality. The provided information does not indicate that unauthenticated users can exploit it.