Live › vulnerability › CVE-2026-108515
Drupal core versions in several ranges fail to neutralize input when generating web pages, allowing Cross-Site Scripting. An attacker can get script to run in a visitor's browser, in the context of the affected site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running Drupal core in the listed version ranges are exposed. The sources do not say which page paths, modules or configurations are needed to trigger the flaw, so unknown whether a default install is affected. Sites on versions outside the listed ranges are not in scope of this entry.
No product ranges from the sources yet.
composer show drupal/core or the Drupal status report.8.9.0 to 10.6.19, 11.0.0 to 11.3.19, 11.4.0 to 11.4.10, and 12.0.0-alpha1 to 12.0.0-beta2.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
This page as .md · .json · in your agent: get_signal("CVE-2026-108515")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.