Live › vulnerability › CVE-2026-114526
The Drupal Black Hole module has a stored cross-site scripting flaw, so malicious script can be saved and run in other users' browsers. The sources do not say what the script can reach beyond the victim's browser session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that run the Black Hole module at an affected version are exposed. Stored XSS usually needs a user who can enter content and a visitor or admin who views it, so the exact role needed is unknown. Sites without the module can skip it.
No product ranges from the sources yet.
drush pm:list --filter=blackhole or the Extend admin page.1.26.0 or earlier, or at 2.0.0 to 2.0.1.0.0.0 to 1.26.0 and from to are affected; the sources do not name a fixed version.2.0.02.0.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS. This issue affects Black Hole versions: from 0.0.0 to 1.26.0, from 2.0.0 to 2.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-114526")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.