Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-25T23:16:56.437Z",
  "pubdate": "2026-08-25T23:16:56.437Z",
  "executiveSummary": "This vulnerability is classified as Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting (XSS).\nIt affects the Drupal core product across a wide range of version branches, specifically 0.0.0 through 11.2.*, 11.3.0 through 11.3.14, and 11.4.0 through 11.4.4.\nThe vulnerability allows unauthenticated or authenticated attackers to inject malicious client-side scripts into web pages rendered by the application.\nSuccessful exploitation poses a significant security risk, as it permits attackers to execute arbitrary JavaScript in the context of a victim's browser session.\nImpacts include session hijacking, unauthorized actions performed on behalf of the user, sensitive data exfiltration (such as CSRF tokens or cookies), and defacement of the rendered interface.\nThe flaw stems from insufficient sanitization of user-supplied input before it is embedded into the DOM, thereby bypassing security controls intended to prevent script injection.",
  "technicalDetails": "The vulnerability is rooted in the failure of Drupal core's output handling mechanisms to adequately sanitize or encode user-supplied data before rendering it within the final HTML structure of a generated web page.\nThis behavior constitutes a classic Cross-site Scripting (XSS) vulnerability, where the application treats malicious input provided by an attacker as legitimate markup or script elements.\nWhen a user or administrator navigates to a component within the Drupal core that improperly handles this input, the browser interprets the injected payload as executable code.\nThe attack flow typically involves an attacker identifying an input vector (such as URL parameters, form fields, or stored data) that is subsequently reflected or persisted in the DOM without proper output escaping or validation.\nBy crafting a payload—typically involving <script> tags, event handlers like 'onload' or 'onerror', or leveraging JavaScript URI schemes—the attacker forces the victim's browser to execute arbitrary scripts.\nThis execution occurs within the security context of the origin where the script is hosted, allowing it unrestricted access to document cookies, session storage, and the ability to perform background HTTP requests.\nBecause the vulnerability exists within Drupal core, it potentially affects any site utilizing affected versions, regardless of custom modules installed.\nThe exploitation does not necessarily require high-level administrative privileges depending on the vector, as stored XSS could be triggered by any user viewing a compromised page.\nOnce executed, the payload can be utilized to hijack active sessions, exfiltrate sensitive administrative credentials, modify the page content to conduct phishing attacks, or propagate malicious payloads through the site's ecosystem.\nThe lack of comprehensive input neutralization mechanisms in the affected versions ensures that even structured, seemingly safe inputs can be manipulated to break out of data containers and enter a script execution context."
}