CVE-2026-108515
The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
The Drupal core Link module provides a field type that can be used for internal and external URLs.
The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities.
Paquets affectés
Packagist
drupal/core
[{"type":"ECOSYSTEM","events":[{"introduced":"8.9.0"},{"fixed":"10.6.19"}],"database_specific":{"constraint":">= 8.9.0 < 10.6.19"}},{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.3.19"}],"database_specific":{"constraint":">= 11.0.0 < 11.3.19"}},{"type":"ECOSYSTEM","events":[{"introduced":"11.4.0"},{"fixed":"11.4.10"}],"database_specific":{"constraint":">= 11.4.0 < 11.4.10"}},{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0-alpha1"},{"fixed":"12.0.0-beta2"}],"database_specific":{"constraint":">= 12.0.0-alpha1 < 12.0.0-beta2"}}]
Références
- web drupal.org