Cross-site Scripting Vulnerability in Drupal Block Attributes
CVE-2026-114534

Currently unrated

Key Information:

Vendor

Drupal
Status
Block Attributes
Vendor
CVE Published:
30 October 2026

What is CVE-2026-114534?

The vulnerability in Drupal Block Attributes arises from improper handling of input during web page generation, which allows for the execution of malicious scripts in the browser of users. Attackers can exploit this flaw to inject arbitrary JavaScript code into web pages, leading to potential data theft, user session hijacking, or other malicious actions. This issue affects versions 0.0.0 up to 2.1.0, highlighting the importance of implementing security best practices and ensuring timely updates to mitigate the risks associated with such vulnerabilities.

Affected Version(s)

Block Attributes 0.0.0 < 2.1.0

References

https://www.drupal.org/sa-contrib-2026-232

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcus Johansson (marcus_johansson)
David Suissa (dydave)
Kostia Bohach (_shy)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Mohit Aghera (mohit_aghera)
Juraj Nemec (poker10)
.