{"id":"CVE-2026-110738","kind":"vulnerability","aliases":["CVE-2026-110738"],"related":[],"title":"Drupal Gin Admin Theme: cross-site scripting lets attackers run scripts in admin pages","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting (XSS). This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 to 5.0.16.","summary":"The Gin Admin Theme for Drupal has a cross-site scripting flaw in how it builds web pages from input. An attacker who gets a crafted input into the page can run script in the browser of a logged-in user, such as an administrator.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","gin-admin-theme","package","php"],"not_affected_if":["gin-not-installed","gin-version-fixed"],"how_to_check":"- Check the installed Gin version in the Drupal project, for example with `composer show drupal/gin` or the Extend page.\n- Confirm whether the site uses the Gin theme as its admin theme.","fix":"- Move Gin Admin Theme to a version past `4.1.4` on the 4.x line, or past `5.0.16` on the 5.x line.","status":"open","published_at":"2026-10-30T04:18:09+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","triaged_at":"2026-10-30T04:31:17+00:00","updated_at":"2026-10-30T04:31:17+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:31:17Z","model":"claude-haiku-5-5","output":{"fix":"- Move Gin Admin Theme to a version past `4.1.4` on the 4.x line, or past `5.0.16` on the 5.x line.","reach":"internet","title":"Drupal Gin Admin Theme: cross-site scripting lets attackers run scripts in admin pages","impact":"medium","summary":"The Gin Admin Theme for Drupal has a cross-site scripting flaw in how it builds web pages from input. An attacker who gets a crafted input into the page can run script in the browser of a logged-in user, such as an administrator.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","php","gin-admin-theme"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in an administrator's browser session","analyst_note":"Check the NVD entry and the Drupal security advisory for the vulnerable input path, the fixed version on the 4.x line, and whether authentication is required.","how_to_check":"- Check the installed Gin version in the Drupal project, for example with `composer show drupal/gin` or the Extend page.\n- Confirm whether the site uses the Gin theme as its admin theme.","plain_action":"","needs_analyst":true,"not_affected_if":["gin-not-installed","gin-version-fixed"],"who_is_affected":"Drupal sites that run the Gin Admin Theme at versions up to 4.1.4 or from 5.0.0 through 5.0.16. The sources do not say which input path is involved or whether anonymous users can reach it, so the exposure of a given site is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000709,"input_tokens":4141,"output_tokens":589,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110738':18A,21A '-2026':17A,20A '0.0.0':108C '4.1.4':110C '5.0.0':112C '5.0.16':114C 'admin':3A,14A,25B,31B,92C,104C 'administr':75B 'affect':102C 'allow':94C 'attack':10A,51B 'browser':65B 'build':45B 'craft':55B 'cross':6A,38B,85C,96C 'cross-sit':5A,37B,84C,95C 'cve':16A,19A 'drupal':1A,22B,34B,90C 'flaw':41B 'generat':83C 'get':53B 'gin':2A,24B,30B,91C,103C 'gin-admin-them':23B 'improp':76C 'input':49B,56B,79C 'issu':101C 'let':9A 'log':69B 'logged-in':68B 'neutral':77C 'packag':27B 'page':15A,47B,59B,82C 'php':28B 'run':11A,61B 'script':8A,12A,40B,62B,87C,98C 'site':7A,39B,86C,97C 'theme':4A,26B,32B,93C,105C 'user':71B 'version':106C 'vulner':88C 'web':46B,81C 'xss':99C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the Gin Admin Theme at versions up to 4.1.4 or from 5.0.0 through 5.0.16. The sources do not say which input path is involved or whether anonymous users can reach it, so the exposure of a given site is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T04:18:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110738","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110738","severity":null,"published_at":"2026-10-30T04:18:09+00:00","modified_at":"2026-10-30T04:18:09+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","fetched_at":"2026-10-30T04:28:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}