{"id":"CVE-2026-107265","kind":"vulnerability","aliases":["CVE-2026-107265"],"related":[],"title":"Drupal Leaflet module: stored cross-site scripting through unsanitized input","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.","summary":"The Leaflet module for Drupal, which renders interactive maps, has a stored cross-site scripting flaw in versions up to and including 10.4.13. An attacker who can save crafted content can run JavaScript in the browser of other users who view the page.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","leaflet","package","self-hosted"],"not_affected_if":["leaflet-not-installed"],"how_to_check":"- Check the installed Leaflet module version in the Drupal admin under Extend, or with `drush pm:list --filter=leaflet`\n- Confirm whether the site uses the Leaflet module at all","fix":null,"status":"open","published_at":"2026-10-30T04:17:56+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","triaged_at":"2026-10-30T04:31:32+00:00","updated_at":"2026-10-30T04:31:32+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:31:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Drupal Leaflet module: stored cross-site scripting through unsanitized input","impact":"medium","summary":"The Leaflet module for Drupal, which renders interactive maps, has a stored cross-site scripting flaw in versions up to and including 10.4.13. An attacker who can save crafted content can run JavaScript in the browser of other users who view the page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","leaflet","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in other users' browsers on the site","analyst_note":"Check the Drupal security advisory for the Leaflet module to confirm the fixed version, the required permissions to inject content, and whether a patched release exists.","how_to_check":"- Check the installed Leaflet module version in the Drupal admin under Extend, or with `drush pm:list --filter=leaflet`\n- Confirm whether the site uses the Leaflet module at all","plain_action":"","needs_analyst":true,"not_affected_if":["leaflet-not-installed"],"who_is_affected":"Drupal sites running the Leaflet module at version 10.4.13 or earlier. Sites without the Leaflet module installed are not affected. The sources do not say whether anonymous visitors can inject content or whether only trusted editors can.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000676,"input_tokens":4111,"output_tokens":529,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107265':14A,17A '-2026':13A,16A '0.0.0':93C '10.4.13':47B,95C 'affect':89C 'allow':84C 'attack':49B 'browser':60B 'content':54B 'craft':53B 'cross':6A,37B,77C 'cross-sit':5A,36B,76C 'cve':12A,15A 'drupal':1A,18B,28B,82C 'flaw':40B 'generat':75C 'host':23B 'improp':68C 'includ':46B 'input':11A,71C 'interact':31B 'issu':88C 'javascript':57B 'leaflet':2A,19B,25B,83C,90C 'map':32B 'modul':3A,26B 'neutral':69C 'packag':20B 'page':67B,74C 'render':30B 'run':56B 'save':52B 'script':8A,39B,79C 'self':22B 'self-host':21B 'site':7A,38B,78C 'store':4A,35B,85C 'unsanit':10A 'user':63B 'version':42B,91C 'view':65B 'vulner':80C 'web':73C 'xss':86C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites running the Leaflet module at version 10.4.13 or earlier. Sites without the Leaflet module installed are not affected. The sources do not say whether anonymous visitors can inject content or whether only trusted editors can.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:17:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107265","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107265","severity":null,"published_at":"2026-10-30T04:17:56+00:00","modified_at":"2026-10-30T04:17:56+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","fetched_at":"2026-10-30T04:28:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}