{"id":"CVE-2026-114534","kind":"vulnerability","aliases":["CVE-2026-114534"],"related":[],"title":"Drupal Block Attributes: stored XSS in versions up to 2.1.0","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0.","summary":"The Drupal Block Attributes module contains a stored cross-site scripting flaw, so script injected into block attributes is saved and runs in visitors' browsers. An attacker who can enter that attribute data can run JavaScript in the context of other users' pages.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["block-attributes","cms","drupal","package"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check whether the Drupal Block Attributes module is installed and at what version, for example with `drush pm:list --filter=block_attributes` or by reviewing the module's `composer.lock` entry.\n- Confirm whether the installed version is within the affected range, from `0.0.0` to `2.1.0`.","fix":null,"status":"open","published_at":"2026-10-30T04:18:12+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","triaged_at":"2026-10-30T04:31:04+00:00","updated_at":"2026-10-30T04:31:04+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:31:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Drupal Block Attributes: stored XSS in versions up to 2.1.0","impact":"medium","summary":"The Drupal Block Attributes module contains a stored cross-site scripting flaw, so script injected into block attributes is saved and runs in visitors' browsers. An attacker who can enter that attribute data can run JavaScript in the context of other users' pages.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","block-attributes","cms"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in other users' browsers, stealing sessions.","analyst_note":"Check the Drupal security advisory for the fixed version and the permission needed to store attributes; the NVD entry alone gives no fix or exploit detail.","how_to_check":"- Check whether the Drupal Block Attributes module is installed and at what version, for example with `drush pm:list --filter=block_attributes` or by reviewing the module's `composer.lock` entry.\n- Confirm whether the installed version is within the affected range, from `0.0.0` to `2.1.0`.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running Drupal with the Block Attributes module installed at a version in the affected range. The sources do not say whether the flaw needs a particular permission to exploit, so the exposed role is unknown. Sites without this module are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000693,"input_tokens":4110,"output_tokens":565,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114534':13A,16A '-2026':12A,15A '0.0.0':94C '2.1.0':10A,96C 'affect':89C 'allow':84C 'attack':50B 'attribut':3A,19B,26B,41B,55B,83C,91C 'block':2A,18B,25B,40B,82C,90C 'block-attribut':17B 'browser':48B 'cms':20B 'contain':28B 'context':62B 'cross':32B,76C 'cross-sit':31B,75C 'cve':11A,14A 'data':56B 'drupal':1A,21B,24B,81C 'enter':53B 'flaw':35B 'generat':74C 'improp':67C 'inject':38B 'input':70C 'issu':88C 'javascript':59B 'modul':27B 'neutral':68C 'packag':22B 'page':66B,73C 'run':45B,58B 'save':43B 'script':34B,37B,78C 'site':33B,77C 'store':4A,30B,85C 'user':65B 'version':7A,92C 'visitor':47B 'vulner':79C 'web':72C 'xss':5A,86C","nicknames":[],"mitigations":[],"who_affected":"Sites running Drupal with the Block Attributes module installed at a version in the affected range. The sources do not say whether the flaw needs a particular permission to exploit, so the exposed role is unknown. Sites without this module are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114534","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114534","severity":null,"published_at":"2026-10-30T04:18:12+00:00","modified_at":"2026-10-30T04:18:12+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","fetched_at":"2026-10-30T04:28:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}