CVE-2026-108515
The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain...
Original description
The description as published by the source.
The Drupal core Link module provides a field type that can be used for internal and external URLs.
The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.
Affected packages
Packagist
drupal/core
[{"type":"ECOSYSTEM","events":[{"introduced":"8.9.0"},{"fixed":"10.6.19"}],"database_specific":{"constraint":">= 8.9.0 < 10.6.19"}},{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.3.19"}],"database_specific":{"constraint":">= 11.0.0 < 11.3.19"}},{"type":"ECOSYSTEM","events":[{"introduced":"11.4.0"},{"fixed":"11.4.10"}],"database_specific":{"constraint":">= 11.4.0 < 11.4.10"}},{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0-alpha1"},{"fixed":"12.0.0-beta2"}],"database_specific":{"constraint":">= 12.0.0-alpha1 < 12.0.0-beta2"}}]
References
- web drupal.org