CVE-2026-110738
Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administrators. The module doesn't suf...
Original description
The description as published by the source.
Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administrators.
The module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes or the administer menu permission.
Affected packages
Packagist:https://packages.drupal.org/8
drupal/gin
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.4"}],"database_specific":{"constraint":"<4.1.4"}},{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.16"}],"database_specific":{"constraint":">=5.0.0 <5.0.16"}}]
References
- web drupal.org