Cross-Site Scripting Vulnerability in Drupal Core
CVE-2026-108514

Currently unrated

Key Information:

Vendor

Drupal
Status
Drupal Core
Vendor
CVE Published:
30 October 2026

What is CVE-2026-108514?

A vulnerability in Drupal core allows for improper neutralization of input during web page generation, leading to Cross-Site Scripting (XSS). This could enable attackers to inject malicious scripts into web pages viewed by users, potentially compromising user data and application security. Affected versions range from 10.3.0 to 10.6.19 and various releases in the 11.x series, including 11.4.0 to 11.4.10 and beta releases of 12.0. The vulnerability underscores the importance of secure coding practices and the need for timely updates to software.

Affected Version(s)

Drupal core 10.3.0 < 10.6.19

Drupal core 11.0.0 < 11.3.19

Drupal core 11.4.0 < 11.4.10

References

https://www.drupal.org/sa-core-2026-016

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eric Tee (erictee2802)
haii haii (hai27ii2o)
C Huaruu (huarui)
Benji Fisher (benjifisher)
Jürgen Haas (jurgenhaas)
Lee Rowlands (larowlan)
Mingsong (mingsong)
Mohit Aghera (mohit_aghera)
James Gilliland (neclimdul)
Pablo López (plopesc)
Juraj Nemec (poker10)
Pierre Rudloff (prudloff)
cilefen (cilefen)
Lee Rowlands (larowlan)
Dave Long (longwave)
James Gilliland (neclimdul)
Juraj Nemec (poker10)
Pierre Rudloff (prudloff)
Jess (xjm)
.