Cross-Site Scripting Vulnerability in Drupal Country Product
CVE-2026-107308

Currently unrated

Key Information:

Vendor

Drupal
Status
Country
Vendor
CVE Published:
30 October 2026

What is CVE-2026-107308?

The Drupal Country product is susceptible to a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user input when generating web pages. This flaw allows attackers to inject malicious scripts, potentially compromising user data and session integrity. Affected versions include 0.0.0 through 2.1.3, as well as 2.2.0 to 2.2.1. It is crucial for users of this product to ensure that they are using an updated version to mitigate this risk.

Affected Version(s)

Country 0.0.0 < 2.1.3

Country 2.2.0 < 2.2.1

References

https://www.drupal.org/sa-contrib-2026-211

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Conrad Lara (cmlara)
Boris Doesborg (batigolix)
Conrad Lara (cmlara)
Swan Kalata (akalata)
Damien McKenna (damienmckenna)
Juraj Nemec (poker10)
.