{"id":"CVE-2026-107306","kind":"vulnerability","aliases":["CVE-2026-107306"],"related":[],"title":"Drupal Menu Link Attributes: stored XSS through menu link attributes","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.","summary":"The Drupal Menu Link Attributes module does not neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store crafted menu link attribute values can run scripts in other users' browsers.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","drupal","package","self-hosted"],"not_affected_if":["module-not-installed","version-above-1.8.0"],"how_to_check":"- Check whether the Menu Link Attributes module is installed on the Drupal site, for example with `drush pm:list --filter=menu_link_attributes`\n- Note the installed version and compare it with the affected range (0.0.0 to 1.8.0)","fix":"- Menu Link Attributes: versions after `1.8.0` are outside the affected range; the sources do not name a specific fixed version","status":"open","published_at":"2026-10-30T04:17:58+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","triaged_at":"2026-10-30T04:31:28+00:00","updated_at":"2026-10-30T04:31:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T04:31:28Z","model":"claude-haiku-5-5","output":{"fix":"- Menu Link Attributes: versions after `1.8.0` are outside the affected range; the sources do not name a specific fixed version","reach":"network","title":"Drupal Menu Link Attributes: stored XSS through menu link attributes","impact":"medium","summary":"The Drupal Menu Link Attributes module does not neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store crafted menu link attribute values can run scripts in other users' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","self-hosted","cms"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Scripts run in other users' browsers, possibly including administrators","analyst_note":"Confirm the fixed version and which role can store the attribute values, from the Drupal security advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-107306 links to it).","how_to_check":"- Check whether the Menu Link Attributes module is installed on the Drupal site, for example with `drush pm:list --filter=menu_link_attributes`\n- Note the installed version and compare it with the affected range (0.0.0 to 1.8.0)","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed","version-above-1.8.0"],"who_is_affected":"Sites running the Drupal Menu Link Attributes module in the affected version range. Exposure depends on who can edit menu link attributes and whether those values are rendered to other visitors. Sites without the module can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000708,"input_tokens":4117,"output_tokens":592,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107306':13A,16A '-2026':12A,15A '0.0.0':89C '1.8.0':91C 'affect':83C 'allow':78C 'attack':44B 'attribut':4A,10A,27B,51B,77C,86C 'browser':59B 'cms':17B 'craft':48B 'cross':40B,69C 'cross-sit':39B,68C 'cve':11A,14A 'drupal':1A,18B,24B,74C 'enabl':37B 'generat':34B,67C 'host':22B 'improp':60C 'input':32B,63C 'issu':82C 'link':3A,9A,26B,50B,76C,85C 'menu':2A,8A,25B,49B,75C,84C 'modul':28B 'neutral':31B,61C 'packag':19B 'page':36B,66C 'run':54B 'script':42B,55B,71C 'self':21B 'self-host':20B 'site':41B,70C 'store':5A,38B,47B,79C 'user':58B 'valu':52B 'version':87C 'vulner':72C 'web':35B,65C 'xss':6A,80C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Menu Link Attributes module in the affected version range. Exposure depends on who can edit menu link attributes and whether those values are rendered to other visitors. Sites without the module can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:17:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107306","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107306","severity":null,"published_at":"2026-10-30T04:17:58+00:00","modified_at":"2026-10-30T04:17:58+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","fetched_at":"2026-10-30T04:28:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}