{"id":"CVE-2026-108515","kind":"vulnerability","aliases":["CVE-2026-108515"],"related":[],"title":"Drupal core: cross-site scripting flaw lets attackers run scripts in pages","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.","summary":"Drupal core versions in several ranges fail to neutralize input when generating web pages, allowing Cross-Site Scripting. An attacker can get script to run in a visitor's browser, in the context of the affected site.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","php","runtime","self-hosted"],"not_affected_if":["version-outside-listed-ranges"],"how_to_check":"- Check the installed Drupal core version with `composer show drupal/core` or the Drupal status report.\n- Compare it against the affected ranges: `8.9.0` to `10.6.19`, `11.0.0` to `11.3.19`, `11.4.0` to `11.4.10`, and `12.0.0-alpha1` to `12.0.0-beta2`.","fix":null,"status":"open","published_at":"2026-10-30T04:18:07+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","triaged_at":"2026-10-30T04:31:17+00:00","updated_at":"2026-10-30T04:31:17+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-30T04:31:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Drupal core: cross-site scripting flaw lets attackers run scripts in pages","impact":"medium","summary":"Drupal core versions in several ranges fail to neutralize input when generating web pages, allowing Cross-Site Scripting. An attacker can get script to run in a visitor's browser, in the context of the affected site.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["drupal","self-hosted","php"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers on the affected site","analyst_note":"Find the Drupal security advisory for CVE-2026-108515 to confirm the fixed versions, the trigger conditions and whether user interaction is needed.","how_to_check":"- Check the installed Drupal core version with `composer show drupal/core` or the Drupal status report.\n- Compare it against the affected ranges: `8.9.0` to `10.6.19`, `11.0.0` to `11.3.19`, `11.4.0` to `11.4.10`, and `12.0.0-alpha1` to `12.0.0-beta2`.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-listed-ranges"],"who_is_affected":"Sites running Drupal core in the listed version ranges are exposed. The sources do not say which page paths, modules or configurations are needed to trigger the flaw, so unknown whether a default install is affected. Sites on versions outside the listed ranges are not in scope of this entry.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000714,"input_tokens":4175,"output_tokens":593,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-108515':16A,19A '-2026':15A,18A '10.6.19':96C '11.0.0':98C '11.3.19':100C '11.4.0':102C '11.4.10':104C '12.0.0':106C,109C '8.9.0':94C 'affect':62B,89C 'allow':40B,81C 'alpha1':107C 'attack':9A,46B 'beta2':110C 'browser':56B 'context':59B 'core':2A,27B,80C,91C 'cross':4A,42B,73C,83C 'cross-sit':3A,41B,72C,82C 'cve':14A,17A 'drupal':1A,20B,26B,78C,79C,90C 'fail':32B 'flaw':7A 'generat':37B,71C 'get':48B 'host':25B 'improp':64C 'input':35B,67C 'issu':88C 'let':8A 'neutral':34B,65C 'page':13A,39B,70C 'php':21B 'rang':31B 'run':10A,51B 'runtim':22B 'script':6A,11A,44B,49B,75C,85C 'self':24B 'self-host':23B 'sever':30B 'site':5A,43B,63B,74C,84C 'version':28B,92C 'visitor':54B 'vulner':76C 'web':38B,69C 'xss':86C","nicknames":[],"mitigations":[],"who_affected":"Sites running Drupal core in the listed version ranges are exposed. The sources do not say which page paths, modules or configurations are needed to trigger the flaw, so unknown whether a default install is affected. Sites on versions outside the listed ranges are not in scope of this entry.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108515","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108515","severity":null,"published_at":"2026-10-30T04:18:07+00:00","modified_at":"2026-10-30T04:18:07+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","fetched_at":"2026-10-30T04:28:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}