CVE-2026-108514
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerabil...
Original description
The description as published by the source.
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.
Affected packages
Packagist
drupal/core
[{"type":"ECOSYSTEM","events":[{"introduced":"10.3.0"},{"fixed":"10.6.19"}],"database_specific":{"constraint":">= 10.3.0 < 10.6.19"}},{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.3.19"}],"database_specific":{"constraint":">= 11.0.0 < 11.3.19"}},{"type":"ECOSYSTEM","events":[{"introduced":"11.4.0"},{"fixed":"11.4.10"}],"database_specific":{"constraint":">= 11.4.0 < 11.4.10"}},{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0-alpha1"},{"fixed":"12.0.0-beta2"}],"database_specific":{"constraint":">= 12.0.0-alpha1 < 12.0.0-beta2"}}]
References
- web drupal.org