Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-09-02T13:17:07.540Z",
  "pubdate": "2026-09-02T13:17:07.540Z",
  "executiveSummary": "The Drupal Entity Browser module contains an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-Site Scripting (XSS).\nThis vulnerability exists due to insufficient sanitization of user-supplied input before it is rendered within the browser context of administrative or front-end users.\nThe flaw affects all versions of the Entity Browser module from 0.0.0 through 2.16.0.\nSuccessful exploitation allows an attacker to inject arbitrary malicious JavaScript into the application, which is then executed within the session context of other users, including those with elevated privileges.\nThe primary risk involves unauthorized actions performed on behalf of legitimate users, such as session hijacking, data exfiltration, or the unauthorized modification of entity content.\nExploitation requires an attacker to possess the capability to submit input that is later stored and subsequently rendered by the entity browser interface.",
  "technicalDetails": "The vulnerability resides in the input handling and output encoding logic within the Entity Browser module. The component fails to correctly neutralize malicious script payloads during the entity creation or editing process, allowing them to be persisted directly into the Drupal database.\nThe root cause is an absence of robust output sanitization or context-aware encoding when rendering data stored within entity fields managed by the module. When the browser retrieves these entities for display, the injected script is treated as legitimate HTML markup, triggering execution in the victim's browser session.\nThe attack flow typically involves three stages: injection, storage, and execution. First, an attacker authenticates and utilizes the Entity Browser interface to submit a crafted payload within an entity field that the module fails to sanitize. This payload is stored in the application backend.\nSecond, a victim—often an administrator with higher-level permissions—accesses the specific entity or administrative view where the malicious content is surfaced. The application fetches the tainted data and injects it into the Document Object Model (DOM) of the page without proper escaping.\nThird, the victim's browser interprets the malicious payload as executable code. Because the script executes within the security context of the victim's session, it gains the ability to interact with the Drupal environment using the victim's cookies and authentication tokens.\nPost-exploitation impact is severe, as it enables the execution of arbitrary JavaScript. This can be weaponized to perform CSRF attacks, capture sensitive data displayed on the page, or perform unauthorized administrative operations, such as creating new administrator accounts or modifying system configurations. The lack of validation on user-provided input ensures that even obfuscated payloads can bypass basic filtering if the underlying framework logic does not enforce strict character neutralization before output rendering.\nThe vulnerability is inherent to the module's processing logic and persists across all versions 0.0.0 to 2.16.0, as these versions lack the necessary input filtering mechanisms to prevent stored XSS attacks."
}