CVE-2026-87939
The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed. The module does not sufficiently validate...
Original description
The description as published by the source.
The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed.
The module does not sufficiently validate or sanitize the RSS feed it generates, resulting in a stored cross-site scripting (XSS) vulnerability.
Affected packages
Packagist:https://packages.drupal.org/8
drupal/feed_block
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2"}],"database_specific":{"constraint":"<2.0.2"}},{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.2"}],"database_specific":{"constraint":">=3.0.0 <3.0.2"}}]
References
- web drupal.org