{"id":"CVE-2026-108514","kind":"vulnerability","aliases":["CVE-2026-108514"],"related":[],"title":"Drupal core: cross-site scripting flaw lets attackers run scripts in pages","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.","summary":"Drupal core versions 10.3.0 through 10.6.19, 11.0.0 through 11.3.19, 11.4.0 through 11.4.10, and 12.0.0-alpha1 through 12.0.0-beta2 contain a cross-site scripting flaw. An attacker can inject script into web pages that a visitor's browser then runs.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","php","runtime","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Drupal core version with `vendor/bin/drush status drupal-version` or by reading `core/lib/Drupal.php`.\n- Compare the version against the affected ranges: `10.3.0` to `10.6.19`, `11.0.0` to `11.3.19`, `11.4.0` to `11.4.10`, `12.0.0-alpha1` to `12.0.0-beta2`.","fix":"- Move to a Drupal core version outside the affected ranges; the specific fixed versions are unknown from the sources.","status":"open","published_at":"2026-10-30T04:18:05+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","triaged_at":"2026-10-30T04:31:17+00:00","updated_at":"2026-10-30T04:31:17+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-30T04:31:17Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Drupal core version outside the affected ranges; the specific fixed versions are unknown from the sources.","reach":"internet","title":"Drupal core: cross-site scripting flaw lets attackers run scripts in pages","impact":"medium","summary":"Drupal core versions 10.3.0 through 10.6.19, 11.0.0 through 11.3.19, 11.4.0 through 11.4.10, and 12.0.0-alpha1 through 12.0.0-beta2 contain a cross-site scripting flaw. An attacker can inject script into web pages that a visitor's browser then runs.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["drupal","php","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs scripts in visitors' browsers on the site","analyst_note":"Find the Drupal security advisory for CVE-2026-108514 to confirm fixed versions, trigger conditions, and severity; the NVD entry lacks these details.","how_to_check":"- Check the installed Drupal core version with `vendor/bin/drush status drupal-version` or by reading `core/lib/Drupal.php`.\n- Compare the version against the affected ranges: `10.3.0` to `10.6.19`, `11.0.0` to `11.3.19`, `11.4.0` to `11.4.10`, `12.0.0-alpha1` to `12.0.0-beta2`.","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Sites running Drupal core in the listed version ranges are exposed. The sources do not say which modules, themes, or configurations are required to trigger the flaw, so any site on an affected version should be treated as in scope until checked.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000751,"input_tokens":4175,"output_tokens":668,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-108514':16A,19A '-2026':15A,18A '10.3.0':29B,96C '10.6.19':31B,98C '11.0.0':32B,100C '11.3.19':34B,102C '11.4.0':35B,104C '11.4.10':37B,106C '12.0.0':39B,42B,108C,111C 'affect':91C 'allow':83C 'alpha1':40B,109C 'attack':9A,52B 'beta2':43B,112C 'browser':63B 'contain':44B 'core':2A,27B,82C,93C 'cross':4A,47B,75C,85C 'cross-sit':3A,46B,74C,84C 'cve':14A,17A 'drupal':1A,20B,26B,80C,81C,92C 'flaw':7A,50B 'generat':73C 'host':25B 'improp':66C 'inject':54B 'input':69C 'issu':90C 'let':8A 'neutral':67C 'page':13A,58B,72C 'php':21B 'run':10A,65B 'runtim':22B 'script':6A,11A,49B,55B,77C,87C 'self':24B 'self-host':23B 'site':5A,48B,76C,86C 'version':28B,94C 'visitor':61B 'vulner':78C 'web':57B,71C 'xss':88C","nicknames":[],"mitigations":[],"who_affected":"Sites running Drupal core in the listed version ranges are exposed. The sources do not say which modules, themes, or configurations are required to trigger the flaw, so any site on an affected version should be treated as in scope until checked.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108514","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108514","severity":null,"published_at":"2026-10-30T04:18:05+00:00","modified_at":"2026-10-30T04:18:05+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","fetched_at":"2026-10-30T04:28:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}