CVE-2026-108514
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerabil...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.
Paquets affectés
Packagist
drupal/core
[{"type":"ECOSYSTEM","events":[{"introduced":"10.3.0"},{"fixed":"10.6.19"}],"database_specific":{"constraint":">= 10.3.0 < 10.6.19"}},{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.3.19"}],"database_specific":{"constraint":">= 11.0.0 < 11.3.19"}},{"type":"ECOSYSTEM","events":[{"introduced":"11.4.0"},{"fixed":"11.4.10"}],"database_specific":{"constraint":">= 11.4.0 < 11.4.10"}},{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0-alpha1"},{"fixed":"12.0.0-beta2"}],"database_specific":{"constraint":">= 12.0.0-alpha1 < 12.0.0-beta2"}}]
Références
- web drupal.org