Stored XSS Vulnerability in Drupal Component Blocks
CVE-2026-84915

Currently unrated

Key Information:

Vendor

Drupal
Status
Component Blocks
Vendor
CVE Published:
22 October 2026

What is CVE-2026-84915?

A security vulnerability in the Drupal Component blocks allows for improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS) risks. This flaw can be exploited to inject malicious scripts into web pages, potentially compromising user data and session information. Affected versions of Component blocks range from 0.0.0 to 1.2.7, emphasizing the importance of prompt updates and security measures to mitigate potential exploits.

Affected Version(s)

Component blocks 0.0.0 < 1.2.7

References

https://www.drupal.org/sa-contrib-2026-123

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcus Johansson (marcus_johansson)
Lee Rowlands (larowlan)
Greg Knaddison (greggles)
Lee Rowlands (larowlan)
.