Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-25T23:17:19.740Z",
  "pubdate": "2026-08-25T23:17:19.740Z",
  "executiveSummary": "This vulnerability is classified as Improper Neutralization of Input During Web Page Generation, specifically a Stored Cross-site Scripting (XSS) vulnerability affecting Drupal core.\nThe flaw allows authenticated or unauthenticated attackers, depending on the specific entry point, to inject malicious scripts into the application. When a victim or administrator views the compromised page, the browser executes the injected script within the security context of the vulnerable site.\nThe impact includes full account compromise, session hijacking, sensitive data exfiltration, and unauthorized actions performed on behalf of the user.\nAffected versions include multiple branches of Drupal core: 0.0.0 to 10.6.13, 11.3.0 to 11.3.14, 11.4.0 to 11.4.4, as well as the 11.0.*, 11.1.*, and 11.2.* development/release lines.\nThe risk is critical as it facilitates persistent client-side code execution. Remediation requires an immediate update to the specified non-vulnerable versions of the Drupal core.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the Drupal core input processing logic to correctly sanitize or escape user-supplied data before rendering it in web pages. This enables Stored XSS, where malicious payloads are permanently stored on the target server (e.g., in a database, configuration file, or filesystem).\nExploitation follows a predictable sequence: First, the attacker identifies an input vector that does not properly neutralize script tags, event handlers, or other executable JavaScript sequences. Second, the attacker submits a specially crafted payload—such as <script>alert(document.cookie)</script>—to the vulnerable input field. The application accepts the input and persists it within its storage mechanism.\nThird, the stored payload is delivered to unsuspecting users (often site administrators) when they navigate to a specific page or administrative panel where the malicious data is retrieved and rendered by the server-side output engine without sufficient sanitization. The browser interprets the payload as legitimate code belonging to the host application's origin, thereby bypassing the Same-Origin Policy (SOP).\nThe vulnerable component resides within the core rendering and data-handling subsystems. Because this is a stored XSS flaw, the payload execution is persistent. An attacker can use this to capture session cookies, exfiltrate CSRF tokens, modify page content via DOM manipulation, or perform arbitrary actions on behalf of the victim session. If the victim has high-level administrative privileges, this vulnerability can lead to full site takeover by creating new administrative accounts, modifying site configuration, or injecting backdoors into themes and modules.\nThe attack is persistent across sessions and does not require constant interaction from the attacker after the initial injection. Authentication and privilege requirements depend on the specific vector identified; if an input field is public-facing, it may be exploited by unauthenticated remote attackers. If the input is only accessible via the back-end, it requires the attacker to have already bypassed authentication or compromised a lower-privileged user account.\nThe technical breadth of affected versions across the 10.x and 11.x branches suggests a systemic issue with how specific data types are handled during the build process of the rendered HTML document, potentially stemming from inadequately configured render arrays or failing to utilize the Drupal 'Xss' filter class in critical UI-facing modules."
}