SA-CONTRIB-2026-335: XSS
This module renders Layout Builder forms inside an iframe in a modal dialog, using the admin theme. The module provides its own Ajax command to open the iframe dialog. This command does not sanitize the dialog options the same way Drupal core does since SA-CORE-2026-001, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must be able to control the Ajax response, or be able to add markup with specific attributes to a page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/layout_builder_iframe_modalto a version that resolves this vulnerability.Fixed in 1.3.9
Event History
Frequently Asked Questions
Who is realistically exposed to this vulnerability?
Sites using the module are exposed when an attacker can control an Ajax response or can add markup with specific attributes to a page. The issue is mitigated when neither capability is available to untrusted users.
What access or capability does an attacker need?
An attacker needs the ability to control the Ajax response used by the module's iframe-dialog command, or the ability to add markup containing specific attributes to a page. The provided information does not identify a required authentication level.
How can I determine whether my site may be affected?
Check whether the site uses composer/drupal/layout_builder_iframe_modal and whether untrusted parties can influence Ajax responses or add markup with attributes to pages where the module's dialog functionality is used.