SA-CORE-2026-015: XSS
The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.4.10Fixed in 11.3.19Fixed in 10.6.19
Event History
Frequently Asked Questions
Who is exposed to this issue?
Drupal installations using the core Link module and affected by the insufficient sanitization of certain markup may be exposed. The provided information does not identify the specific configurations or circumstances that trigger the issue.
What impact could successful exploitation have?
Successful exploitation can result in cross-site scripting (XSS), allowing attacker-controlled markup to execute in another user's browser within the affected Drupal site.
What attacker capability is indicated by the available information?
The issue involves insufficient sanitization of certain markup associated with the Link module's internal or external URL field type. The provided information does not state what permissions, input path, or user interaction are required.