Cross-site Scripting Vulnerability in Drupal Black Hole
CVE-2026-114526

Currently unrated

Key Information:

Vendor

Drupal
Status
Black Hole
Vendor
CVE Published:
30 October 2026

What is CVE-2026-114526?

A Cross-site Scripting (XSS) vulnerability exists in Drupal's Black Hole module, which allows attackers to inject malicious scripts into web pages. This vulnerability affects versions 0.0.0 to 1.26.0 and 2.0.0 to 2.0.1, enabling stored XSS attacks that could compromise user data and site integrity. It is crucial for users to update to the latest version of the Black Hole module to mitigate this security risk.

Affected Version(s)

Black Hole 0.0.0 < 1.26.0

Black Hole 2.0.0 < 2.0.1

References

https://www.drupal.org/sa-contrib-2026-223

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Drew Webber (mcdruid)
Florian Radut (florian)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Drew Webber (mcdruid)
Juraj Nemec (poker10)
.